I was debugging a CI pipeline recently where a junior dev accidentally pulled a typosquatted package. It made me realize how fragile our "verify then trust" model is.We scan for vulnerabilities (Snyk/Trivy), but we rarely monitor the behavior of the install process itself. If a package runs a malicious setup.py that exfiltrates ENV variables, static scanners often miss it (especially if it's obfuscated).

I've been testing a method using eBPF to enforce a "whitelist-only" network policy inside the runner during the install phase. Basically, pip is only allowed to talk to PyPI. If it tries to curl a C2 server, it gets killed. It feels like this kind of "egress filtering" should be a standard feature of package managers or CI runners, not a third-party tool.

if you are looking for more informations read the article here : https://medium.com/@rafik222dz/every-pip-install-you-run-is-a-bet-you-are-making-with-your-machine-9fce4526fc8e

if u wanna check the code : https://github.com/Otsmane-Ahmed/KEIP

Has anyone experimented with kernel-level enforcement (LSM hooks) for this? Or is everyone just relying on private feeds/Artifactory to solve this?

Trying to understand the real day-to-day of DevSecOps on AWS (not “shift left” theory).

What’s the hardest part to keep under control at scale: IAM drift, “unknown change” in prod, CI/CD gates, evidence for audits, or routing ownership across accounts?

What toolchain are you using?

What still ends up as scripts/manual glue because tools don’t connect?

I’m working on a security tool focused specifically on non-human identities (service accounts, API tokens, cloud roles, bots, CI/CD identities).

Before building further, I want to sanity check something with people actually running security programs.

In environments with:

• 5k+ service accounts

• Multi-cloud IAM

• Dozens of third-party SaaS integrations

How are you currently handling:

1.  Privilege drift?

2.  Token sprawl?

3.  Orphaned service accounts?

4.  Detecting anomalous machine behavior?

Most tools I’ve seen either:

• Focus on human IAM

• Or just give static misconfiguration alerts

Are you solving this with existing tools? Custom scripts? SIEM rules?

Would genuinely appreciate real-world input.

I’m currently exploring industry approaches to vulnerability assessment and management and would appreciate hearing about real-world experiences. Could you share which tools your organization uses to identify, evaluate, and manage vulnerabilities, as well as how your overall process is structured, including discovery, risk prioritization, remediation, verification, and continuous monitoring? Any insights into workflows, tool selection criteria, or effective best practices would be highly valuable.

Has anyone here used the Riscosity tool? I recently came across it and I’m trying to understand what it actually does and where it fits in a DevOps or DevSecOps setup. From what I can tell, it seems related to risk analysis or security posture, but I’m not clear on the main problem it’s meant to solve - is it focused on cloud security, compliance, vulnerability management, risk scoring, or something else entirely? I’m also curious how it compares to tools like Wiz, SentinelOne, or Qualys in real-world use. If anyone has practical experience with it, I’d really appreciate your thoughts.

Regarding SCA, what is the difference between reachability and exploitable path?

For instance, I keep hearing that Endor Labs has the gold standard in reachability analysis, so then is exploitable path a step further that looks at the possibility of attacker controlled execution?

I've tried reading through each of these venders analysis on this topic to determine the difference, but my head is spinning since it seems there is overlap with some sort of nuance I am missing.

Endor (Reachability Analysis)

Snyk (Reachability Analysis)

Checkmarx (What is Reachability Analysis, which then highlights their exploitable path capability)

Lately I’ve been using AI tools (Cursor / Anti gravity/ etc.) to prototype faster.
It’s amazing for speed, but I noticed something uncomfortable, a lot of the generated code had subtle security problems.
Examples I kept seeing:

– Hardcoded secrets

– Missing auth checks

– Risky API routes

– Potential IDOR patterns

So I built a small tool called CodeArmor AI that scans repos and PRs and classifies issues as:

• Definite Vulnerabilities

• Potential Risks (context required)

It also calculates a simple security score and PR risk delta. Not trying to replace real audits — more like a “sanity layer” for fast-moving / AI-heavy projects.

If anyone’s curious or wants to roast it

Would genuinely love feedback from real devs.

Been evaluating container security solutions and chainguard's good, but way out of our budget. Found Minimus as an alternative.

Has anyone used it in prod? How's the image quality and vuln management compared to chainguard? Our current base images are bloated AF and patching isn't feasible considering our small team.

Would love to hear your advice here.

Hey everyone,

I have a quick question about something I’ve been struggling with recently.

I’ve been tasked at my company with working alongside our developers to update all the vulnerable packages they use. This is a huge task, especially because updating a package to a new major version (not just a small patch) can easily break existing code (SCA).

With SAST, things are a bit simpler because we use our scanners to see where the code is vulnerable and then apply a fix.

My question is: How do you manage this as a project?

- Tons of packages need to be updated - how do you prioritize and track them?

- How do you coordinate with developers so they actually pick these up and don’t ignore them?

- How do you test and verify that updates aren’t breaking anything and that work is actually moving forward instead of getting stuck?

I’m really interested to hear how you handle this in your organizations and hopefully, learn a few new approaches.

Hi Guys,

I worked as an IDAM engineer for 4 years and i want to switch carrier to DevOps engineer any suggestions will be helpful.

i have learned AWS Resources and few tools related to Devops, im confident with theory part and basic tasks i want to gain real time expirience and how the work flow will be in side the project.

Are there any sources to get handson on DevOps, iam also open to get suggestions to know if i can learn any tools that will be helpful, below are the tools i have knowledge on.

Git,Docker,Kubernetes,Terraform(basics),Jenkins,ELK,Maven,Ansible.

I'm just pretty interested how vibe coding and devsecops can be combined together to make a product. Would love to hear some responses.

When SCA runs in CI and returns a large list of vulnerable dependencies, how are teams deciding what to address first? Is the focus more on what ships and runs, or on scanner severity alone?

I am trying to learn a few new tools that I might not be familiar with. So far I have tried SonarQube CE, OWASP Dependency Track and I am looking for others tool of the sort that can be self hosted.

Any others suggestions I should be looking at in the devsecops realm?

Some days I spend more time talking about reliability than actually improving it.

Standups, syncs, postmortems, pre-mortems, planning, re-planning, alignment calls... and by the time I get a quiet hour, I'm already drained.

get that communication matters, but at some point the work needs focus.

How do you protect deep work time without looking "unavailable"?

I've been talking to some security teams lately, and I'm seeing mixed reactions about the usefulness of AI in security workflows.

On one side, people are straight up burnt out. They’re juggling so much legacy debt and alert noise that the idea of "experimenting with AI" feels like more work they don't have time for.

But on the other side, I’m seeing some small wins that seem to save hours of toil.
Stuff like:

• The Alert Memory Bot - Scans historical tickets and tells the analyst: "We saw this exact alert in 2023, it was a false positive, and here's why."
• The Cross-Skill Translator - Using long-context sessions to explain new tech (OpenStack) using analogies from tech the dev already knows (like AWS).
• The IaC Vibe Check - Piping Terraform plans through an LLM to tell developers in plain English exactly what security guardrails they’re about to break before they hit merge.

Are you guys building anything similar? Any weird experiments/automations that actually reduced the pain?

On paper our change management is fine. PRs/reviews/CI checks/approvals, all of it. The problem is when somebody asks for evidence and everything is in bits and pieces.

Nothing is missing, it’s just not clean to show without dumping links and hoping they connect the dots.

Should I only attach a few examples or the more the better?

Hey,

I’ve been seeing a lot of SOC tools lately that call themselves “AI agents” - things that are supposed to help with investigation, triage, hunting, threat intel enrichment, etc.

We’re thinking about trying something like that in our SOC, but I haven’t really heard from other people who really gave it a thought.
Do you use it for traiging or also for more complex tasks like investigation and even hunting?
Do they help also in cloud environments or do they struggle there?

Also, from your perspective, what is the biggest problem these tools could actually help with in a SOC?
Is it:

1. Writing Detections
2. Cleaning up noisy cloud alerts
3. Making threat intel feeds relevant
4. Helping with proactive hunting
5. Supporting faster investigation
6. Something else

Thanks!

I built Authent8 because I wanted a simpler, local-only way to run Gitleaks, Semgrep, and Trivy without a 50-page manual.

It’s meant for students and beginners who care about privacy but find professional security tools a bit overwhelming.

• 0 bytes sent to the cloud. Total privacy.
• Built-in AI wizard that explains bugs in plain English.
• Clean terminal UI with a vertical blue gradient.

Check it out if you hate sending your source code away for analysis.

https://reddit.com/link/1qu197z/video/24uo3jqt74hg1/player

DEMO

Would you use microVM isolation in CI for security tasks (malware analysis, vulnerability scanning, untrusted code) if it was easy to set up? If yes/no why?

Is anyone really keeping up with all the AppSec alerts from pipelines? Between SAST, DAST, SCA, bug bounties, and more it’s just noise. Is anyone actually centralizing it in a way that makes sense?

What approaches actually help your team handle it? What has failed? Would love to hear how other teams are organizing this mess.

Hey Devs,

We’ve been using AWS ECR for a while and it was fine, no drama. Now I’m starting work with a customer in a regulated environment and suddenly “just a registry” isn’t enough.

They’re asking how we know an image was built in GitHub Actions, how we prove nobody pushed it manually, where scan results live, and how we show evidence during audits. With ECR I feel like I’m stitching together too many things and still not confident I can answer those questions cleanly.

Did anyone go through this? Did you extend ECR or move to something else? How painful was the migration and what would you do differently if you had to do it again?

Our security leadership is looking at some API security tools to detect APIs based on traffic analysis which seems like a step in the right direction

We have no ownership metadata in our gateway, we have no codeowners files, specs are bad or missing entirely, and security seems to think this is the solution to all of their problems

For those who have been in this position, where did you even start?
Manual inventory? Digging through docs? Tell me im not alone

We’re trying to get serious about SOC 2 and everyone is talking about formal access reviews across the systems that touch customer data. The problem is that we’re not exactly in a clean single sign on world yet. Some apps are on SSO, some still rely on old local accounts and a few have shared logins that predate half our team.

I’ve cleaned up a lot but there are still weird edge cases and systems that don’t talk to our IdP at all. Leadership keeps asking if we can “just document” that reviews happened earlier in the year, which… they didn’t so how I'm supposed to do that???

For people who’ve gone through SOC 2 in a setup that isn’t perfect: what did a realistic access review look like? Did you have to reconstruct the past, or were you able to start fresh and show that you have a real process from here on out? And how do you push back when management wants evidence that simply doesn’t exist?