Introduction

The vulnerabilities that do not live in a single line of code, and why the tool that finds 300 issues still misses the one that matters.

Musa Ndlala: this article is a bit late but better late than never

What I learned rolling out Application Security inside a large engineering organization

Category: AWS Security | DevSecOps | Cloud Security | Secrets Management

K02 — base64 is not encryption, etcd stores everything, and every pod has a credential it may not need.

AI can write code in seconds. But shipping secure code still requires engineering judgment.

The goal of DevSecOps isn’t to slow developers down. It’s to help them build secure software without getting in their way.

TL;DR A critical Gitea vulnerability, CVE-2026-58443 (CVSS 9.6), lets a public-only token push commits into a private repository. Maintainers fixed it in v1.27.0. The security advisory publishes b…

Every major platform now has an AI that suggests security fixes. Only one proves the vulnerability is exploitable in your live…