We're considering moving away from Atlassian because our environment must remain fully on-premises and cannot move to cloud-only services. GitLab seems like the obvious replacement, but I'd like…
I'm moving into a Project Manager role within a DevSecOps organization, but I don't have a technical background. I'd like to build enough knowledge to work effectively with…
I recently moved into a Project Manager role at a company that uses a DevSecOps approach. I don't have a technical background, but I'm expected to build knowledge…
Our team has lengthy release cycles, and the security backlog grows significantly between releases. Even when we use hardened base images, new vulnerabilities accumulate before the next deployment.…
Our release cycles are extremely long, and the security backlog grows between releases. I'm spending more time responding to tickets than doing productive work. Even when we use…
Traditional endpoint security tools may not inspect files inside containers because the container filesystem is isolated from the host. I'm not asking about vulnerability scanning—I'm specifically interested in…
I'm coming from a cybersecurity background with experience across Windows and Linux, VS Code, PowerShell, security automation, vulnerability research, software versions and dependencies, and code repositories. I understand…
I'm coming from a cybersecurity background with experience across Windows and Linux, VS Code, PowerShell scripting, security automation, vulnerability research, software versions, dependencies, and code repositories. I understand…
We scan container images in CI and block releases when critical vulnerabilities are found. An image passed the scan and was deployed, but about three weeks later the…
We scan container images in CI and block releases when critical vulnerabilities are found. An image passed the scan and was deployed, but about three weeks later the…
Tools like Trivy, Syft, and Grype are useful, but a single successful scan only tells you what was known at that moment. If a new CVE is published…
Security scanners are useful, but a single successful scan in CI only tells you that the dependencies looked acceptable at that moment. If a new CVE is published…
Third-party Python packages are essential for many projects, but every dependency introduces potential supply-chain risk. Private repositories, vulnerability scanning, curated packages, and stricter review policies can all help,…
I'm in a non-technical role within a technology team, but my work requires read access to our staging cluster and write access to testing environments. I'm not a…
Third-party Python packages are incredibly useful, but every dependency introduces potential supply-chain risk. Private repositories, vulnerability scanning, dependency pinning, and stricter reviews can help, yet they may also…
I'm in a non-technical role within a technology team, but my work requires read access to our staging cluster and write access to some testing environments. I was…
Our leadership wants engineering teams to start adding autonomous AI-agent capabilities directly into our SaaS application. So far, our AI experience has mostly been developer-assistance tools used to…
Our cybersecurity team expects us to upgrade to the newest Python release as soon as it becomes available. The concern is that libraries and their dependencies may not…
I transitioned into DevOps from an Arts background and have about 3.3 years of experience across four companies. My work has included AWS, Kubernetes, Terraform, CI/CD, automation, and…
I'm a penetration tester working on a CI/CD integration with Checkmarx. I understand the basics, but I need guidance on three areas: securely managing pipeline secrets, running authenticated…