DevTech Deep Dive

Three incidents this year reveal how supply-chain compromises and credential mismanagement converge.

• Injective's npm SDK (v1.20.21) was backdoored...

Skip Maven installs in CI/CD by using curl to push artifacts directly.

• Fetch a CodeArtifact auth token via environment variable
• PUT the JAR: curl...

ModelAudit now requires environment variables exclusively for cloud and registry authentication, improving security by avoiding CLI flag exposure in...

Configure wolfTPM to restrict post-quantum algorithms to specific operations only.

• Use --enable-mldsa=verify-only and --enable-mlkem=enc to drop...

• Provenance reveals an artifact's origin and build process—SBOMs only list contents, letting pipelines reject unsigned or tampered releases.
  -...

Build-Time Attestations & CI Gates

• 🔥 The SBOM you can trust is the one your build actually made: Compares BuildKit in-toto attestations (bound...

Software supply chains are shifting from unverified claims to signed, verifiable attestations at every stage.

• Commit level: World of Code dataset...

Metabase only reads SQL databases, so every SaaS integration needs a pipeline that extracts, loads, models, and visualizes data on a schedule.

Key...

Build System Security Risks

• 🔥 Kotlin Build Cache CVE: CVE-2026-53914 allows code execution via unsafe deserialization in JetBrains Kotlin build...

Red Hat's Dependency Analytics 1.0 extension scans manifest files like package.json, Cargo.toml, and go.mod in real time inside VS Code, Cursor, and...

CVE-2026-53914 enables code execution via unsafe deserialization in Kotlin build cache metadata for versions before 2.4.20.

• Privileged context:...

Step-by-step guide to deploying ASP.NET Core apps across environments using Classic release pipelines.

• Enable continuous deployment triggers on...

Attested Marketplace Patterns

• 🔥 Pin the SHA Yourself: Introduces marketplace.json SHA pinning with inverted verification-before-proposal and...

Supply-chain worms now harvest credentials to poison further packages, making simple removal pointless once secrets are exposed.

• Credential...

AWS Inspector uses SSM to auto-install VM Scanner on eligible EC2 instances for periodic vulnerability scans.

• Prerequisites: SSM Agent running, IAM...

The sbom-tools Rust CLI brings production-ready SBOM capabilities straight into CI/CD pipelines with a security-first design.

• Supports semantic...

EVSE Secure Release Pipelines

• 🔥 From CI/CD to Fleet Risk: Presents an engineering workflow that turns CI/CD into an observable, reproducible,...

Runtime SBOM Generation

• 🔥 MemSBOM with Volatility 3: Presents a memory forensics tool that traverses Python interpreter internals (garbage...

• Spearbit verifies bytecode matches source via deterministic rebuilds, then issues personal Sigstore attestations that travel with the exact...

• MemSBOM traverses Python interpreter internals including garbage collector, thread stacks, and heap arenas to recover truly loaded modules.
• Unlike...