#DevSecOps

Articles about DevSecOps — exploring patterns, best practices, and real-world implementations in production systems.

10 posts tagged with devsecops. ← All posts

#A2A (5)#ADK (8)#AG-UI (6)#AI (9)#AI Agents (212)#AI Engineering (39)#AI Governance (16)#AI Red Teaming (8)#AI Safety (6)#AI Security (16)#AML (3)#API Design (9)#API Security (8)#APIs (37)#AWS (9)#Accounting (9)#Agent Skills (3)#Agentic AI (24)#Agentic Commerce (12)#Agents (4)#Amazon Bedrock (8)#Architecture (36)#Audit (3)#Automation (6)#Azure (11)#Azure AI Foundry (9)#Backend Engineering (220)#BigQuery (6)#CI/CD (7)#Capital Markets (14)#Card Payments (12)#Cards (13)#Career (7)#Checkpointing (4)#Claude Code (8)#Cloud Architecture (3)#Code Review (8)#Collaboration (4)#Communication (4)#Compliance (42)#Concurrency (23)#Consulting (3)#Cost Optimisation (5)#Credit (14)#Credit Risk (14)#Crypto (12)#Cryptocurrency (12)#Custody (9)#Data (4)#Data Structures (3)#Databases (14)#Deployment (3)#DevSecOps (10)#Developer Experience (3)#Distributed Systems (64)#Documentation (3)#Embeddings (11)#Engineering (7)#Engineering Culture (3)#Engineering Practices (16)#Evaluation (31)#FREE-AI (8)#FX (5)#FinOps (5)#FinTech (6)#Financial AI (14)#Financial Systems (122)#Fintech (116)#Foreign Exchange (5)#Forward Deployed Engineer (8)#Forward Deployed Engineering (8)#Fraud (10)#Function Tools (5)#GCP (5)#Go (220)#Google ADK (36)#Governance (46)#Granite (6)#GraphQL (3)#Guardrails (21)#HIPAA (3)#HTTP (3)#Harness Engineering (8)#Human-in-the-Loop (8)#IBM watsonx (8)#Integration (3)#Interfaces (3)#KYC (11)#KYC and AML (12)#Kubernetes (8)#LLM (5)#LLMs (45)#LangGraph (11)#Ledger (12)#Lending (14)#MCP (10)#MLOps (3)#Machine Learning (12)#Markets (4)#Memory (8)#Microservices (3)#Microsoft Agent Framework (150)#Middleware (6)#Migration (9)#Monitoring (3)#Multi-Agent (10)#Multi-Agent AI (14)#Multi-Agent Systems (49)#Multimodal (3)#NIM (5)#NVIDIA (8)#OWASP (7)#Observability (25)#Open Source (6)#OpenTelemetry (4)#Opinion (6)#Orchestration (10)#Payment Rails (16)#Payments (51)#Performance (6)#Privacy Engineering (3)#Product (4)#Production (6)#Programming (10)#Prompt Engineering (26)#Prompt Injection (7)#Providers (4)#Python (89)#Quality (3)#RAG (23)#RBI (3)#REST (5)#Rails (16)#Reconciliation (3)#Regulation (9)#Reliability (27)#Resilience (3)#Responsible AI (4)#Retrieval (3)#Risk (13)#SRE (4)#Scalability (3)#Security (63)#Sessions (3)#Settlement (9)#Software Architecture (9)#Software Engineering (94)#Spanner (4)#Streaming (21)#Structured Output (4)#System Design (8)#Testing (30)#Tool Use (9)#Tools (3)#Trading (8)#Treasury (6)#Type System (3)#Type Systems (3)#Vector Databases (8)#Vector Search (3)#Workflows (14)#gRPC (4)
Pratik Dhanave · ·14 min read

Continuous Security: Monitoring, Compliance, and Culture

The DevSecOps series finale — shifting right to runtime, turning compliance into code, closing the incident feedback loop, measuring what matters, and the culture that makes secure the default path.

The capstone: shifting right to continuous security — runtime detection and vulnerability management as a loop, security observability and tamper-evident audit, compliance-as-code with evidence from the pipeline, metrics that matter, and the culture (paved roads, champions).

#DevSecOps#Monitoring#Compliance#Culture#Security#Governance#Observability
Pratik Dhanave · ·13 min read

The Secure API Lifecycle

The finale of the API Security series — how to bake security into the way APIs are designed, built, tested, shipped, and operated, so that every control from the previous seven posts becomes a repeatable part of the pipeline instead of a one-time heroic effort.

The capstone: baking security into the API lifecycle — shift-left threat modeling, CI gates (SAST, SCA, secret scanning, spec-driven authz/BOLA and DAST tests that fail the build), an OWASP-API-Top-10-to-control map, and incident response.

#API Security#DevSecOps#Testing#OWASP#Security#APIs
Pratik Dhanave · ·13 min read

Container and Kubernetes Security

Securing the runtime platform end to end — hardened images, least-privilege workloads, default-deny networks, and admission control as the gate that decides what is ever allowed to run.

Securing the runtime platform: minimal non-root images scanned for CVEs, the container isolation model and hardening (drop caps, read-only FS, seccomp), and Kubernetes — Pod Security Standards, RBAC, default-deny NetworkPolicies, and admission control (Gatekeeper/Kyverno).

#DevSecOps#Kubernetes#Containers#Security
Pratik Dhanave · ·13 min read

Securing the AI Pipeline

Part seven of the AI Security Engineering series: DevSecOps for AI systems — securing the secrets, network, supply chain, prompts, and CI/CD gates that surround the model, so a hardened model doesn't sit inside a soft pipeline.

DevSecOps for AI: secrets in a manager not code, least-privilege runtime identities (no ambient prod creds for agents), egress control, rate/spend limits against model DoS, supply-chain verification in CI, prompts-as-code, and a security-eval gate that fails the build.

#AI Security#MLSecOps#DevSecOps#Security#Evaluation#Prompt Engineering
Pratik Dhanave · ·15 min read

Infrastructure as Code Security and Policy as Code

Why your Terraform is a security control point, how misconfiguration scanners catch public buckets and open ingress before apply, and how to encode org guardrails as executable policy with OPA/Rego, Conftest, and Sentinel instead of a wiki page nobody reads.

Securing infrastructure definitions and enforcing guardrails automatically: IaC scanning (Checkov/tfsec/Trivy) for misconfig, drift detection, and policy-as-code with OPA/Rego + Conftest so org rules block bad infra before apply — not in a wiki.

#DevSecOps#IaC#Policy as Code#OPA#Security#Guardrails
Pratik Dhanave · ·14 min read

Secrets Management: Keeping Credentials Out of Code and Under Control

How to move from hardcoded passwords toward dynamic, short-lived, audited credentials — the hierarchy from bad to good, the role of a real secrets manager, and why a leaked secret is compromised the instant you push it.

Keeping credentials out of code and under control: the bad-to-good hierarchy, secrets managers (Vault/KMS), dynamic short-lived secrets, rotation that consumers actually pick up, and workload identity / OIDC so CI and services never store a long-lived key.

#DevSecOps#Secrets#Security#Vault
Pratik Dhanave · ·13 min read

Software Supply Chain Security and SBOMs

Securing everything you didn't write — from finding known-vulnerable dependencies with SCA, to generating an SBOM you actually act on, to proving provenance with signatures and SLSA so you know and verify what you ship.

Securing everything you didn't write: SCA for known-vulnerable dependencies, the supply-chain threat model (typosquatting, dependency confusion, build compromise), SBOMs (SPDX/CycloneDX), and provenance/integrity with SLSA and Sigstore signing.

#DevSecOps#Supply Chain#SBOM#SLSA#Security
Pratik Dhanave · ·12 min read

SAST, DAST, and Security Testing in CI

How the four families of automated security tests — static analysis, dynamic analysis, secret scanning, and instrumented runtime testing — fit together across a pipeline, and why tuning signal-to-noise matters more than adding scanners.

Automated security testing in the pipeline: SAST vs DAST vs IAST and their trade-offs, secret scanning (including git history), where each runs, and making findings actionable so false-positive fatigue doesn't get the scanner muted.

#DevSecOps#SAST#DAST#CI/CD#Security#Testing
Pratik Dhanave · ·14 min read

Secure SDLC and Threat Modeling

How to design security in from the first sketch instead of bolting it on before launch — mapping security work to every phase of the software lifecycle, grounded in the NIST Secure Software Development Framework, and using STRIDE-based threat modeling as the core design activity.

Designing security in from the start: the secure SDLC mapped to NIST SSDF, security requirements and abuse cases, and threat modeling with the four questions and STRIDE — data-flow diagrams, trust boundaries, and continuous (not one-time) modeling.

#DevSecOps#Threat Modeling#Secure SDLC#NIST#Security
Pratik Dhanave · ·11 min read

What DevSecOps Is

The opening post of a DevSecOps series — how security stops being a gate at the end of delivery and becomes an automated, shared responsibility built into every stage of the pipeline.

The opener to a DevSecOps series: building security into the delivery lifecycle instead of bolting it on — shift-left (and shift-right), security as everyone's job, the CI/CD pipeline as the enforcement point, and the automated controls the series wires up.

#DevSecOps#Security#CI/CD#Automation

All posts on this site are written by Pratik Dhanave, an Agentic AI Architect with 7+ years building production distributed systems, multi-agent AI platforms, and cloud-native infrastructure. About the author → Each article includes working code, architecture diagrams, and references to the specific frameworks and standards discussed. Browse all posts or explore related topics using the tag cloud above.