DevSecOps
Every Inline Code post tagged DevSecOps, ordered most recent first.
2 posts
19 min read
AI supply chain security: four ways code now enters your estate without a vendor review
Model weights, agent skills, MCP servers and packages your coding assistant invented all execute in your environment, and none of them trigger a vendor assessment. The documented incidents, the measured scale, and the controls that close the gap before CPS 230 makes it an audit finding.
- Supply chain
- Third-party risk
- AI agents
3 min read
Securing CI/CD pipelines without slowing engineering down
Pipeline security is the gap between policy and reality. Most regulated firms have written rules about code review and signed releases that the actual pipeline does not enforce, and the audit evidence is whatever the runner happened to print to stdout.
- CI/CD
- Platform engineering
- Supply chain
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.