DevSecOps & Security
Software supply-chain trust, tenant boundaries, permissions and incident practices.
Research-design drafts identify proposed methods and limitations. They do not claim completed experiments.
Does an SBOM Make Remediation Faster?
An inventory can speed dependency identification, but it does not resolve exploitability or upgrade compatibility. Remediation research should separate finding an affected component from deciding what to do about it.
Signed Builds, Untrusted Inputs
An authentic artifact can still contain unwanted behaviour if the build consumed unsafe inputs. Provenance helps explain how an artifact was produced; that evidence must be checked against a policy.
Secret Scanning and Exposure Duration
A detection event is not the end of an exposure. The important chain runs from introduction to discovery, revocation and confirmation that the old credential no longer works.
Least Privilege for GitHub Actions Deployments
Deployment permissions should match the job's responsibilities. A working pipeline with broad privileges proves task completion, not that the permission boundary is appropriate.
SOC Alert Fatigue: Signal Quality Before Alert Volume
Alert fatigue is partly a decision-quality problem: responders need to know which signals justify investigation. An alert count does not tell you whether the queue is actionable.
When Security Gates Encourage Unsafe Workarounds
A control that repeatedly blocks legitimate work may encourage informal exceptions. The question is whether a gate improves the release decision or merely moves the risk into an undocumented path.
Multi-Tenant Data Isolation Beyond Login
Tenant isolation must follow data through APIs, caches, exports and background work. Authentication at the front door cannot establish that every later operation uses the right tenant context.
Identity Boundaries for AI Agents
An agent's useful autonomy depends on the privileges of its tools. A narrowly worded prompt cannot substitute for a technically enforced access boundary.
Threat Modelling a Django AI Application
A threat model should follow data and authority, including retrieval documents, model calls and tool actions. The model is one component of the application, not the entire security boundary.
Incident Readiness Versus Policy Readiness
A written procedure matters when people can use it under uncertainty. Tabletop exercises expose unclear ownership and decision dependencies without requiring a live incident.