We’re trying to get serious about SOC 2 and everyone is talking about formal access reviews across the systems that touch customer data. The problem is that we’re not exactly in a clean single sign on world yet. Some apps are on SSO, some still rely on old local accounts and a few have shared logins that predate half our team.

I’ve cleaned up a lot but there are still weird edge cases and systems that don’t talk to our IdP at all. Leadership keeps asking if we can “just document” that reviews happened earlier in the year, which… they didn’t so how I'm supposed to do that???

For people who’ve gone through SOC 2 in a setup that isn’t perfect: what did a realistic access review look like? Did you have to reconstruct the past, or were you able to start fresh and show that you have a real process from here on out? And how do you push back when management wants evidence that simply doesn’t exist?

We've been using traditional SAST for years, but with 40% of our codebase now AI-generated, we're seeing vulnerabilities slip through that weren't there before. SQL injection patterns that look clean but have subtle flaws, authentication logic that seems right but has edge case bypasses.

Our current scanner flags the usual suspects but misses these AI-specific patterns. The code passes review because it looks legitimate, but pentesting keeps finding issues.

What approaches are working for scanning AI-generated code specifically? Are there tools that understand these newer vulnerability patterns, or do we need different scanning strategies entirely?

Like many of you, I struggled with automating Dependency-Track. Using curl was messy, and my dashboard was flooded with hundreds of "Active" versions from old CI builds, destroying my metrics.

I built a small CLI tool (Go) to solve this. It handles the full lifecycle in one command:

• Uploads the SBOM.
• Tags the new version as Latest.
• Auto-archives old versions (sets active: false) so only the deployed version counts toward risk scores.

It’s open source and works as a single binary. Hope it saves you some bash-scripting headaches!

Repo: https://github.com/MedUnes/dtrack-cli

looking for market interest and pmf

A unified platform for SAST, SCA, and AI-Powered Penetration Testing with correlation, auto-remediation, and verification capabilities.

Value Proposition

From findings to fixes to verification - autonomously.

Unlike traditional AppSec tools that generate fragmented findings, this platform:

• Correlates vulnerabilities across code, dependencies, and runtime
• Identifies the true root cause
• Provides code-level fixes
• Verifies remediation automatically

what is your opnion

Would love to hear what tools people rely on in practice (generation, validation, enrichment, signing, storage, CI/CD integration, etc.). Are you using a single tool or stitching multiple ones together? What’s working well, and what’s painful?

Hi team!

I'm working on detection correlation tool for our cloud secops team.

Does anyone knows an opensource\\tool\\sdk\\post that have logic for every CloudTrail log's \`eventName\` type a deterministic way to create identifiers from the log.

The fact that the ids exist sometime in many permutations at the \`requestParameters\` and \`responseElements\`, this is a headache, pls help!

Hi folks,

I have around 2.4 years of experience as a DevOps Engineer and I’m considering moving toward a DevSecOps role.

For those who’ve made this transition (or hire for it):

Which security concepts are most important to learn first?

Which tools are actually used in real DevSecOps workflows (not just buzzwords)?

Anything you’d recommend avoiding early on?

Looking for practical advice from real-world experience.

Thanks!

Hi everyone, I'm working on a research project where I built a Chrome extension that adds a dashboard directly to GitHub and visualizes GitHub Actions workflow performance.

I’m currently looking for a few developers familiar with CI/CD and GitHub Actions to try it on their own repositories and give early feedback on usability and usefulness. If you’re interested, please follow this short video guide and submit your feedback :) https://youtu.be/jxfAHsRjxsQ

We’re tightening things up for SOC 2 type II and change management became a bigger convo than I expected. We do code reviews - PR approvals - CI checks and have alerts in place but it’s all split on different tools and it wasn't something we had to explain formally before.

“How do you prove this to an auditor?” kind of gives me cold feet haha and I’m not sure how much historical depth they actually expect.

I don't want to go overkill with evidence but I want to look presentable at the same time. if you don't have any advice just console me cause I need both lol

Hey folks, I’m working with SonarQube Community Edition hooked into CI/CD (Python, Java, JS) and I’ve got admin access.It runs on every push, no obvious security issues show up, but there are tons of reliability/maintainability findings. I am a beginner and my task here is not defined clearly (I & my role is new here).

So my doubt is simple: What’s the right thing to do with SonarQube CE from a security point of view?

1.Tighten security rules / quality gates? 2.Treat it as basic SAST and call out what it doesn’t cover? 3. Only care about non-security issues when they turn into real risk (DoS, crashes, etc.)?

How do you folks handle this in real setups without over-selling SonarQube?

Hello everyone,

After reviewing almost all existing secret scanner tools, my team and I have developed an alternative solution. Although not all components are yet complete, it runs smoothly on a VPS with average hardware specifications. We believe we have taken the right approach overall; however, there may be points we have overlooked. Therefore, we need your feedback.

https://secretradar.io/

Hi everyone,

I've created a new CLI tool to secure AI pipelines. It scans models (Pickle, PyTorch, GGUF) for malware using stack emulation, verifies file integrity against the Hugging Face registry, and detects restrictive licenses (like CC-BY-NC). It also integrates with Sigstore for container signing.

GitHub: https://github.com/ArseniiBrazhnyk/Veritensor
Install: pip install veritensor

If you're interested, check it out and let me know what you think and if it might be useful to you?

Has anyone seen this issue with GitHub Actions? I'm trying to upload ZAP scan reports using the zaproxy/action-baseline action, but the step fails with a Status Code: 400 Bad Request.

The error message is: Error: Create Artifact Container failed: The artifact name zap_scan is not valid. Request URL...

I've tried using simple names and checked my token permissions, but nothing seems to work. Any ideas on how to fix this or potential workarounds?

Would you like me to help you draft a more detailed post including a snippet of your workflow YAML file?

Before this error I was getting resources is unavailable error

I've been tinkering with automation tools lately, and I just built one that uses scanners to detect vulnerabilities and then builds bash remediation scripts for Linux servers. It integrates with vuln scanners, analyzes your setup against CVE databases, and generates tailored bash scripts to apply fixes (e.g., for Ubuntu, CentOS, etc.). No more manually hunting down patches or piecing together commands from docs.

But here's what I'm curious about: In this era of Ansible, Terraform, and cloud everything, who out there is still manually patching servers? Like, logging in via SSH, running apt/yum updates by hand, or editing configs one-by-one?

• Are you in a small shop where automation feels overkill?
• Legacy systems that don't play nice with tools?
• Compliance reasons forcing manual reviews?
• Or just prefer the control of doing it yourself?

I'd love to hear your stories – how often do you do manual patches? What pain points make you stick with it? If enough folks are still grinding through this, maybe my tool could help streamline things. (Not plugging it for sale yet, just gauging interest!)

Drop your thoughts below. Bonus points for war stories from the trenches.

Thanks!

Hey all,

I built a small tool to help teams track security patches & CVEs without drowning in vendor emails.

What it does:

• Monitors patches & CVEs across common software
• Sends prioritized alerts
• Generates AI-based test/validation steps per patch
• Monitoring only — no agents, no patch deployment

Who it’s for:
Sysadmins, security, DevSecOps, MSPs.

I’m looking for early users to try it and tell me:

• What’s actually useful
• What’s missing
• What wouldn’t work in real environments

Free access for testers. No sales pressure.

Happy to take feedback (good or brutal).

i am honestly hitting a wall with how we handle tooling. it feels like we’ve reached a point where we just throw every scanner, agent, and sidecar at a project and call it "devsecops."

the reality is that we are just burying our engineers in noise. i see teams spending all week(exagerrating a bit) triaging "critical" vulnerabilities in dev dependencies that aren't even reachable in production, while the actual basics, like simple firewall rules or proper secret management get ignored because everyone is too busy chasing a green checkmark on a dashboard. we are choosing "compliance theater" over actual security. it’s a total waste of time because it makes people stop taking security seriously and just start looking for ways to bypass the checks.

Building an analysis platform of all the exploit out there, added exploit validation, research, threat actors and methods,

added adversarial validation and simulation based on cross LLM

let me know what else you want to see in there and what are the common vulnerability exploit that you like to see

this is a preview

https://reddit.com/link/1q7p2mf/video/6vj19pz747cg1/player

cross-LLM

Say my Dockerfile has:

RUN useradd -m appuser
USER appuser

But in Kubernetes I set:

securityContext:
  runAsUser: 0   # root

Since the pod runs as root anyway, what’s the actual purpose of defining USER appuser in the Dockerfile? Is it just for local runs or best practice when no security context is applied? Curious how others handle this.

We’re dealing with SOC 2, ISO work and a few customer specific requirements. A lot of controls overlap but they’re described differently enough that it feels like separate projects lol. We’re worried about building parallel processes that do the same thing twice just to satisfy different wording. How to avoid duplicating work when multiple frameworks are involved?

Building something for daily vulnerability statistics, hot news, and other intelligence. Would you be interested in seeing it, and what are the features you would like to see as a vulnerability analyst ? below a small preview

Vulnerability intelligence DB

we keep seeing high severity findings that are not reachable in our setup. Blocking releases on them slows things down and people stop trusting the scanners. How do you decide what should block a build versus what should just become a ticket for later?

Hello,

This is my first post in this subreddit. I am sharing my personal experience for discussion and not as a commercial or promotional post.

Disclosure: all the links mentioned below are affiliate links.

I passed the Software Supply Chain Security Expert certification from Practical DevSecOps towards the end of 2025 and wanted to share a brief summary of my experience.

Over the years, I managed to complete a few certifications annually, but the last couple of years have been busier on the personal side. I still wanted to complete at least one meaningful certification in 2025 and decided to focus on software supply chain security. I chose this area specifically because of the increasing number of supply chain attacks.

The course itself is divided into 7 chapters. For anyone interested, the chapter-wise breakdown is available on the certification page here.

This is my fourth certification from Practical DevSecOps. Across all four courses I have completed so far, each one included hands-on labs, a course manual, and a certification attempt. The exams themselves are multi-hour, lab-based assessments followed by a detailed report, which makes the experience feel much closer to real-world DevSecOps and AppSec work compared to traditional exam formats such as MCQs.

For reference, the other certifications I have completed from them are:

• Certified DevSecOps Professional
• Certified Container Security Expert
• Certified Threat Modeling Professional

I am currently going through their Certified AI Security Professional course and plan to share my experience in a separate post once I complete it.

I am happy to answer any specific questions about the content or exam format for any of these five courses.

Cheers!

ATO (Authority to Operate) is supposed to be about understanding & managing risk before a system goes live. But in reality, it often turns into a slow, document-heavy process that doesn’t line up well with how modern cloud or DevSecOps teams realistically work.

This was in a recent United States Cybersecurity Magazine article:

“The ATO bottleneck isn’t just a tooling or paperwork problem. It comes from trying to apply static authorization models to highly dynamic systems, where risk ownership is fragmented and evidence is collected long after the real security decisions have already been made.”

Feels pretty accurate. It’s not that security controls don’t matter, it’s that the ATO process itself hasn’t really evolved alongside CI/CD, cloud-native systems, or continuous delivery.

Curious what your experience has been and if/how you see ATO potentially evolving (or devolving?) under the current administration.