Blog
Security governance for engineering teams
Writing on CVE remediation time, SBOM generation, policy as code, transitive dependency risk, and how platform teams govern dependency estates without turning security into a gate.
Platform Engineering and Dependency Governance: Two Sides of the Same Problem
Platform teams own the paved roads. Dependency governance is what keeps those roads from developing potholes no one notices until production.
Open Source License Risk in Enterprise Codebases: What Legal Actually Cares About
Most security tools flag GPL as a blanket risk. The reality is more nuanced, and ignoring the nuance creates compliance theater, not compliance.
Auto-Merge Safety: When Repohelm Opens PRs Automatically
Auto-merge is only safe when it's bounded. Here's how Repohelm's eligibility rules prevent unintended production breakage.
Writing a Dependency Policy Your Team Will Actually Follow
A policy nobody reads is not a policy. Four principles for writing governance rules that developers treat as guardrails, not bureaucracy.
CVE Remediation Time: The Metric That Actually Matters
Mean time to remediate is a lagging indicator most teams track badly. Here's a tighter measurement model that reveals where your security backlog actually stalls.
Detecting Supply Chain Drift Across 200 Repositories
When your engineering estate grows past 50 repositories, manual dependency audits stop working. Here's how automated policy evaluation fills the gap.
Engineering Governance Without the Gate
Security gates that block merges are the wrong model. Here's why pull requests are the right mechanism, and what that shift means for how you write policy.
Transitive Dependency Risk: What Your Lockfile Actually Hides
Direct dependencies get the attention. Transitive dependencies, the ones 3 levels deep, are where supply chain attacks actually land.
Renovate vs. Dependabot vs. Repohelm: An Honest Comparison
All three open pull requests for dependency updates. They're solving different problems. Here's how to think about which one belongs in your stack.
How AI Triage Reduces PR Noise in Dependency Scanning
Raw CVSS scores generate too much noise. Reachability-aware AI triage cuts the signal-to-noise ratio from 1:8 to roughly 1:1.5.
Policy as Code vs. Policy as Documentation: Why the Format Determines Adoption
A Confluence page describing your dependency rules is documentation. A .repohelm.yaml file checked into git is policy. The difference in adoption is not subtle.
SBOM Generation for Multi-Repo Engineering Estates
A software bill of materials is only useful if it reflects the full dependency graph. Here's what breaks when you generate SBOMs repo by repo, and how to fix it.
Why Dependency Pinning Is Not a Security Strategy
Pinning versions stops unexpected upgrades. It does not stop CVEs published against the version you've pinned. Here's what a real dependency governance strategy looks like.