Notes from the line.

Most threat intel is not for you. The useful part is a fast answer to one question: is this advisory in what we actually run?

Trace a container in production back to its commit, build and pull request using image digests, OCI labels and attestations.

Required reviewers on a production environment only work if the person who wrote the change cannot also approve it. Run this checklist to find out.

A checklist to run in one meeting before you invite outside researchers: disclosure basics, scope, triage SLAs, reward structure and the loop that turns reports into fixes.

Five controls, one working day: encrypted disk, secrets out of dotfiles, protected SSH keys, signed commits and tokens that can only do their job.

Broken access control is the bug QA is best placed to catch. A role by endpoint matrix and a few lines of pytest make it routine.

Every pentest finding tells you how someone attacked you. Use it twice: fix the bug, then write the detection that would have caught the attempt.

Route every package through one proxy, make new versions wait a few days, switch off install scripts and let the lockfile decide.

Short policies mapped to real controls, with evidence pulled from your pipelines, beat long documents nobody opens until the audit.

You cannot security-review every pull request. Route the few that matter to people who know what to look for, using paths and CODEOWNERS.

Editor extensions run as your code, with your files and your tokens. How they work, how to inventory them, and how to build an allowlist people will accept.

Three artefacts, three questions: what is inside, who built it and has it changed. Here is how to produce and check each one.

A station-by-station plan for the lone security engineer, plus four measures that tell you whether the program is actually working.

A single threat model document is out of date the week after the workshop. Split it into layers and update each one when that layer changes.

An MCP server runs with your tokens, your filesystem and your network. Here is what that means, and how to inventory and scope it.

Tags move, SHAs do not. Pin every action, let a bot keep them current and cut the token down to what each job needs.

A pentest report is a list of bugs with evidence. Triage it, reproduce it, fix the root cause, and make sure each finding can never quietly return.

If your architecture diagram cannot show where trust changes, it cannot tell you where the attacks go. Here is how to draw one that does.

Running every scanner on every commit is easy. Getting developers to read the output is the real work, and it starts with showing less.

Four ways a bad package reaches your build, what each one looks like in a manifest or a log, and how to check yourself.

When to hire, which profile to look for first, what the first 90 days should produce, and when a fractional lead is the smarter opening move.

Write the misuse story in the same ticket as the feature, and security requirements stop being a document nobody opens.

Why the best threat models happen with business, developers and cyber in one room, and how to run one in an hour.