Software Supply Chain Security in 2026: Pinning, Provenance, Signing, and SBOMs That Get Consumed
A few years ago, “supply chain security” meant checking your Docker base images for critical CVEs and hoping your dependency
Tag: CI/CD
Defending Against Supply Chain Attacks: An npm and PyPI Defense Playbook
When a popular npm package turns malicious, the window between publication and detection is measured in hours, and the first
Continue readingDefending Against Supply Chain Attacks: An npm and PyPI Defense Playbook
Secrets Management in Practice: From Hardcoded Credentials to Short-Lived Identity
Most breaches involving secrets do not involve sophisticated attacks. They involve a credential that was committed to a git repository
Continue readingSecrets Management in Practice: From Hardcoded Credentials to Short-Lived Identity
Helm Chart Hooks: Injecting Lifecycle Jobs into Kubernetes Deployments
Most Helm tutorials stop at templating manifests and calling it a day. But production deployments rarely fit neatly into “render,
Continue readingHelm Chart Hooks: Injecting Lifecycle Jobs into Kubernetes Deployments
SBOMs in Practice: Generating, Scanning, and Surviving Supply Chain Audits
The software supply chain has become the soft underbelly of modern applications. While teams harden their APIs, patch their runtimes,
Continue readingSBOMs in Practice: Generating, Scanning, and Surviving Supply Chain Audits
Argo CD v3.5: Helm 4, mTLS, and a Maturing Source Hydrator
Argo CD v3.5.0 landed on August 4, 2026, bringing substantial changes that touch nearly every layer of the GitOps controller
Continue readingArgo CD v3.5: Helm 4, mTLS, and a Maturing Source Hydrator
Feature Flags with OpenFeature: Decoupling Deployment from Release in Go
Every engineering team reaches the same breaking point: the deploy-to-release coupling. You want to ship code to production, but you
Continue readingFeature Flags with OpenFeature: Decoupling Deployment from Release in Go
Container Image Scanning with Trivy: Catch Vulnerabilities Before They Ship
Container images are your application’s most deployable artifact — and potentially its biggest attack surface. Every base image you inherit,
Continue readingContainer Image Scanning with Trivy: Catch Vulnerabilities Before They Ship
Faster Docker Builds with BuildKit: Cache Mounts, Remote Caching, and Bake
Docker image builds are one of those things that quietly accumulate technical debt. You start with a simple Dockerfile, and
Continue readingFaster Docker Builds with BuildKit: Cache Mounts, Remote Caching, and Bake
Zero-Downtime Deployments on Kubernetes: From Rolling Updates to Progressive Delivery
Deploying new code to production without taking your service offline is table stakes for modern applications. Kubernetes gives you rolling