Blog
Notes on cybersecurity, DevSecOps, and shipping secure software.
Draugr gates its own CI
Draugr's repository is held to the same P1 gate it asks users to adopt, run by the published release on every pull request that changes code, every push to main, every weekday, and every tag before it ships.
Don't make the model rank it
Two findings arrive looking the same, and one is a leaked private key. Left to a model, the choice of which to fix first comes out differently every time.
The monorepo your scanner thinks is one app
One repository, many services, one number. Whose findings are these, which are urgent, and whose merges does a red build stop? None of it is in the code.
The VEX analysis your supplier already did
Your supplier already worked out which CVEs do not apply. Reading their VEX beats retyping it, and that supplier is often the platform team down the hall.
A misconfiguration has no CVSS, which is why nobody fixes it
A privileged pod and a public bucket have no CVE and no CVSS, so every IaC tool invents a severity and the breach sorts below an unreachable dependency.
CIS benchmarks are somebody else's checklist
A benchmark flags things you chose deliberately. The value is not the score, it is the short list you decided not to meet and the record of who decided.
Most of your container CVEs aren't yours
Scan a 35-line Python app and get 292 findings. 219 come from the base image, and none are fixable by changing your code. What the actionable move is.
Shift left became run everything on every commit
What got built was twelve scanners on every push, eleven minutes, and a pipeline people bypass. The useful version is about latency, not location.
The TLS certificate nobody was watching
Expired certificates take down more services than TLS vulnerabilities compromise. The check is trivial, the failure total, and it is owned by nobody.
The ignore file is where security programs go to die
Every scanner ships a way to make findings disappear. Risk acceptance is fine; losing who accepted it, why, and until when is what kills the program.
The license nobody gated on: copyleft in your tree
A CVE is embarrassing and fixable. A copyleft obligation you shipped for two years is neither, and you find out during due diligence. How to gate on it.
Threat intelligence in a build pipeline
A SOC firehose pointed at a CI job produces noise nobody actions. Scoped to the hosts and images you declared, it answers what the outside world has seen.
What authenticated DAST actually costs
An unauthenticated scan reaches the login page. Everything worth finding is behind it, which means credentials, session handling and an API spec.
You don't need twelve scanners, just the four that apply
Teams adopt security tooling as nothing or everything at once, and both fail because nobody decided which controls their software actually needs.
Your CI logs are not evidence
A screenshot of a green build will not survive the follow-up: which version, which checks, against what data, and would it answer the same way twice.
Your CSP is strong and broken, and a grade will not tell you
Header tools grade a Content-Security-Policy on strength. Whether it works depends on the page it protects, which is why so many stay in report-only mode.
Your SBOM is half an answer: pair CycloneDX with VEX
An SBOM tells customers what you are made of, and hands them every CVE they can match against you. VEX is the other half, and you have mostly written it.
Security findings in your editor, from standard SARIF
A finding you have to go looking for is one you fix later. Draugr writes standard SARIF, so a scan opens as inline squiggles in VS Code with no plugin.
Why we didn't build an AI pentester
Models find bugs in code they have never seen. That leaves untouched what tooling is for: the same answer every time, cheap enough for every commit.
Point your AI assistant at Draugr
Ask an assistant to check your repo and it will, using whatever scanner it finds over a scope it chose. On our demo that missed 78 of the top 99.
Scan any repo for vulnerabilities with zero config
Most tools want config before a result. draugr scan . runs SAST, SCA, secret and IaC checks over a repo with no descriptor, and ranks what it finds.
What to fix first when everything is critical
Severity is not priority. What matters depends on where a problem lives and what the business would lose, which is context a scanner cannot see.
Describe your app, not your scanners
Teams wire up scanners instead of describing software, and it breaks at scale. One declarative descriptor covers Trivy, Semgrep and Gitleaks at once.