https://www.msbiro.net/tags/supply-chain-security/ Recent content in Supply-Chain-Security on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Mon, 27 Jul 2026 00:00:00 +0000 https://www.msbiro.net/posts/shadow-ai-cicd-kubernetes-threat-model/ Mon, 27 Jul 2026 00:00:00 +0000 https://www.msbiro.net/posts/shadow-ai-cicd-kubernetes-threat-model/ Shadow AI turns ungoverned coding assistants and agents into a live threat across CI/CD. A stage-by-stage threat model from developer laptop to Kubernetes pod, with the executive controls and tooling that contain the risk. https://www.msbiro.net/posts/hardened-images-catalog-2026-non-negotiable/ Wed, 24 Jun 2026 09:30:00 +0100 https://www.msbiro.net/posts/hardened-images-catalog-2026-non-negotiable/ Why hardened container image catalogs are non-negotiable in 2026: the technological case, the DORA mandate, and the NIS2 obligations explained. https://www.msbiro.net/posts/athena-coalition-open-source-security/ Tue, 16 Jun 2026 10:14:00 +0100 https://www.msbiro.net/posts/athena-coalition-open-source-security/ Athena is a new industry coalition for coordinated open source vulnerability defense. Here is what it means for DevSecOps teams and security leaders. https://www.msbiro.net/posts/lazarus-group-git-hooks-malware-developers/ Wed, 06 May 2026 09:00:00 +0100 https://www.msbiro.net/posts/lazarus-group-git-hooks-malware-developers/ North Korea's Lazarus Group embeds malware in git hooks to compromise developers through fake job interviews. Attack breakdown and five practical defences. https://www.msbiro.net/posts/supply-chain-attack-prevention-8-controls/ Sun, 26 Apr 2026 12:00:00 +0100 https://www.msbiro.net/posts/supply-chain-attack-prevention-8-controls/ Bitwarden CLI, Trivy, and Axios compromised in three weeks. Your EDR won't catch postinstall scripts. 8 practical controls to reduce the blast radius. https://www.msbiro.net/posts/gsd-sbom-drift-spec-driven-development/ Mon, 13 Apr 2026 05:32:00 +0000 https://www.msbiro.net/posts/gsd-sbom-drift-spec-driven-development/ Another SDD experiment: using GSD (Get Shit Done) v1.34.2 with GitHub Copilot and GPT-5.4 to bootstrap sbom-drift from a docs-only repo to working Go code. Installation, project initialization, Phase 1 execution, and honest lessons from the session. https://www.msbiro.net/posts/openclaw-security-analysis/ Sat, 31 Jan 2026 01:44:33 +0000 https://www.msbiro.net/posts/openclaw-security-analysis/ A comprehensive security analysis of the OpenClaw AI assistant project. Examining three name changes in 10 days as a confusion attack pattern, exposed cloud instances due to misconfiguration, the fake VS Code plugin incident, and the hidden costs of running AI agents on your own API keys. Why I can't use this tool with my real accounts despite being an AI enthusiast. https://www.msbiro.net/posts/evaluating-oss-security-fresh-editor-s2c2f/ Sat, 27 Dec 2025 16:37:11 +0000 https://www.msbiro.net/posts/evaluating-oss-security-fresh-editor-s2c2f/ Holiday hacking from the couch: evaluating Fresh editor's security using OpenSSF Scorecard, Semgrep, and cargo audit. A practical guide to applying the S2C2F framework for secure OSS adoption without killing developer productivity. Learn how to vet unknown open-source tools in an afternoon before bringing them to corporate environments. https://www.msbiro.net/posts/k8s-security-2025-graduates-2026-preview/ Mon, 08 Dec 2025 10:05:05 +0000 https://www.msbiro.net/posts/k8s-security-2025-graduates-2026-preview/ Recap of Kubernetes security features that reached stable in 2025 + predictions for 2026 graduates. DevSecOps guide to production hardening. https://www.msbiro.net/posts/the-case-for-hardened-container-image-catalogs/ Sat, 29 Nov 2025 10:00:00 +0000 https://www.msbiro.net/posts/the-case-for-hardened-container-image-catalogs/ Why traditional vulnerability scanning isn't enough and how a hardened image catalog is essential for modern enterprise security and regulatory compliance.