Tag
3 posts
A supply chain attack turned Trivy, a popular security scanner, into a credential stealer inside CI/CD pipelines. How to harden for all three stages, preventing the compromise, limiting the damage, and recovering fast.
How to decide where proactive security effort goes when nothing is telling you what to do next. Spot your weakest capability, define "good enough," and know when to move on instead of over-optimising one area.
How to run a security evaluation when a new SaaS vendor lands on your desk, including risk tiering, what to check, reading a SOC 2, Singapore and global compliance, and starter templates.