All news with #devsecops tag

🤖 We built a CI-native orchestration system around OpenCode that launches up to seven specialised AI reviewers per merge request, each focused on domains like security, performance, code quality, documentation, release management, and internal compliance. A coordinator agent deduplicates and rates structured XML findings, applies a conservative approval-biased rubric, and posts a single unified review. Deployed across thousands of merge requests, it approves clean code, blocks critical issues, and reduces median review latency to 3m39s while keeping human oversight.

🧭 Cloudflare introduces Flagship, a native feature-flag service built on the CNCF standard OpenFeature that evaluates flags at the edge using Workers, Durable Objects, and KV. The Worker binding performs in-isolate evaluations with typed accessors and full evaluation details, avoiding external HTTP calls and reducing latency. Flagship centralizes flag storage, change auditing, percentage rollouts, and nested targeting rules, and is now available in private beta to help teams safely ship autonomous or AI-assisted code.

🔒 Advances in AI are accelerating vulnerability discovery and compressing the window between disclosure and exploitation. Francis deSouza explains why organizations must rapidly harden code, lock down CI/CD and build systems, and automate remediation to avoid being overwhelmed by machine-speed attacks. The article advocates integrating defensive AI—agentic SecOps, continuous asset discovery, and Google Cloud Model Armor—while securing AI agents using frameworks like SAIF to prevent prompt injection and data leakage.

🤖 Drasi's team turned documentation testing into a monitoring problem by running AI-driven synthetic users that follow tutorials verbatim inside Dev Containers using the GitHub Copilot CLI. The agent is naïve, literal, and unforgiving: it executes commands exactly, verifies outputs, and captures screenshots, terminal logs, and a final markdown report. Weekly automated runs detect silent drift and environment regressions; failures automatically file issues with reproducible artifacts.

🔒 Recent weeks have seen multiple high-profile supply chain compromises, including malicious modifications to Axios and repository hijacks by TeamPCP that impacted tools such as Trivy. These incidents highlight how widely used libraries can rapidly propagate risk and complicate inventory and remediation efforts. The report emphasizes securing identity and CI/CD pipelines, maintaining accurate software inventories, prioritizing rapid patching, and reinforcing fundamentals like segmentation, robust logging, and multi-factor authentication to limit impact and lateral movement.

🔒 Modern vulnerability management must go beyond scanning version numbers to encompass download policies, AI guardrails, and build-pipeline controls. Organizations should adopt a trusted internal artifact registry, rigorous component screening, and dependency pinning to reduce supply-chain and malicious-package risks. Complement these controls with enriched vulnerability intelligence, SCA, and developer training. Systematic handling of EOL or abandoned components — via migration, LTS, or compensatory controls — completes the approach.

⚠️Silos between endpoint, SOC, and backup teams increase incident impact and slow recovery. The article identifies six common failures—unclear roles, fragmented asset and risk views, mismatched policies, disconnected tools, absent cross-team drills, and siloed metrics—and offers concrete fixes. Build a unified RACI, consolidate inventories and logs, align retention and playbooks, integrate EDR/SOC/backup workflows, run joint simulations, and measure resilience with shared KPIs. N-able is presented as a vendor that unifies management, security operations, and data protection to enable automation, faster detection, and safer recovery.

🔍 AWS announces general availability of AWS Transform custom's comprehensive codebase analysis transformation, delivering up-front deep static analysis that documents architecture, technical debt, code metrics, and migration plans to preserve institutional knowledge and reduce documentation overhead. The transformation supports any language — including Python, Java (Maven and Gradle), Node.js, and .NET — and scales to codebases exceeding one million lines. Behavior analysis is available in early access. To run it locally, install the AWS Transform CLI and execute: atx custom def exec -n AWS/comprehensive-codebase-analysis -p. The service is available in US East (N. Virginia) and Europe (Frankfurt).

🛠️ AWS announced seven new AWS-managed transformations for Transform custom, designed to accelerate code modernization across multiple languages and frameworks. General availability includes a comprehensive codebase analysis that produces hierarchical, cross-referenced documentation and a Node.js version upgrade with full dependency modernization. Early access transformations target Java performance tuning, Log4j to SLF4J migration, Angular to React conversion, and Angular and Vue version upgrades. All AWS-managed transformations are validated, customizable, and benefit from continual learning; the service is available in US East (N. Virginia) and Europe (Frankfurt).

🔐 The UK NCSC's chief executive Richard Horne told the RSA Conference (March 24) to 'seize the disruptive vibe coding opportunity' while urgently developing safeguards. He warned AI-assisted development can either reduce systemic vulnerability or propagate new flaws depending on model design and controls. NCSC CTO David C published Secure Vibe Coding Commandments advocating secure-by-default models, provable provenance, AI-powered audits, deterministic guardrails and sandboxed hosting.

🔐 NTT Security warns of a newly disclosed malware strain called StoatWaffle that automatically executes when developers open and trust weaponized Visual Studio Code folders. The threat leverages a crafted .vscode/tasks.json with a runOn: folderOpen setting to trigger a Node.js-based loader, credential stealer and RAT without explicit user action. Operators attributed to WaterPlum are evolving the long-running Contagious Interview campaign to target developer workflows and toolchains.

🧭 Project Helix automates onboarding for Cloudflare One, converting deployment expertise into reusable, language-aware Terraform templates and a Cloudflare Workers UI. In minutes, tenants receive baseline DNS, network, and HTTP security policies, TLS inspection options, and granular SaaS tenant controls. Administrators can toggle recommended protections to deploy consistent, error‑free configurations quickly.

🔍 A new DataDog State of DevSecOps report finds 87% of organizations run at least one exploitable software vulnerability in production, affecting roughly 40% of services. Vulnerabilities are most prevalent in Java (59%), .NET (47%) and Rust (40%). After accounting for runtime and contextual factors, only 18% of critical dependency CVEs remain critical, with .NET seeing a 98% downgrade rate. The report urges contextual prioritization to reduce alert noise and operator burnout.

🚀 vinext was built in one week by a single engineer guided by AI to reimplement the Next.js API on top of Vite. It functions as a near drop-in replacement—use vinext dev / vinext build / vinext deploy—to run App Router and Pages Router apps and deploy directly to Cloudflare Workers. Early benchmarks report up to 4.4x faster production builds and client bundles up to 57% smaller versus Next.js; the effort cost roughly $1,100 in tokens. The experimental open-source project includes extensive tests, ISR support, pluggable caching, and an optional Traffic-aware Pre-Rendering feature.

🤖 AWS IAM Policy Autopilot, the open-source static analysis tool introduced at re:Invent 2025, is now available as a Kiro power. The integration enables one-click installation from the Kiro IDE and web interface, removing the need for manual MCP server configuration and speeding baseline IAM policy creation. Developers can generate and refine policies inside their coding workflow to support rapid prototyping and ongoing application evolution.

🔒 The push to 'shift left' has largely failed because it places excessive security responsibility on developers who are pressured to prioritise speed. Ivan Milenkovic of Qualys highlights how noisy, slow tools and misplaced trust in public container registries let malicious images and embedded secrets slip into deployment pipelines. He urges organisations to proxy external images, create a golden path of approved templates and CI pipelines, and shift down security into platform engineering so controls are automatic and developer friction is minimised.

🔍 The John Lewis Partnership’s platform team redefined how it measures the value of its internal developer platform, moving beyond simple tenant counts. They began with lead-time metrics for service creation, onboarding and first-customer deliveries, then adopted DORA metrics and a Technical Health score to capture operational quality and resilience. Combining telemetry with developer-experience feedback helped prioritise paved roads, automate change handling and simplify security assurance to reduce friction and speed delivery.

🔍 John Lewis moved beyond simple adoption counts to measure whether its internal developer platform actually delivered value. Initially the team tracked practical lead-time metrics — Service Creation Lead Time, Onboarding Lead Time, and First Customer Lead Time — to show speed to production and prioritize improvements. Over time they adopted DORA metrics, centralized telemetry in BigQuery and dashboards, automated change handling, and introduced a Technical Health score to guide investments and reduce developer friction.

🔍 John Lewis Partnership outlines a pragmatic approach to selecting monitoring metrics for its developer platform, stressing that impressive numbers alone don't prove platform health. They pair objective DORA benchmarks with recurring qualitative engineer feedback via DX, and track feature adoption and technical hygiene through a custom Backstage plugin. Individual checks run as small jobs, results land in BigQuery, and insights are surfaced as aggregated views, per-team tasks, and leaderboards to drive targeted improvements.

🚀 This article demonstrates a full-stack architecture that uses Flutter for the web frontend and Dart for the backend, enabling shared models and business logic across client and server. It walks through a To-Do example that places the domain model in a shared package, uses Shelf to serve both API routes and static web files, and compiles the server to a native executable for fast startup. Deployment options include Cloud Run's OS-only runtime for mounting precompiled artifacts or a Dockerfile-based multi-stage build for portable containers, and the article includes CI guidance using GitHub Actions to automate analysis, tests, and web builds.