dx
3 posts · all writing
Shift left became "run everything on every commit", which is why people turned it off
The idea was that feedback is cheaper the earlier it arrives. What got built was a pipeline that runs twelve scanners on every push, takes eleven minutes, and gets bypassed. The useful version is about latency and relevance, not about location.
Findings where you're already looking: SARIF in your editor and the Security tab
A security finding you have to go looking for is a finding you fix later. Draugr writes standard SARIF, so a scan opens as inline squiggles in VS Code or JetBrains with no plugin of ours. Here is what it takes to make that actually work.
Scan any repo for vulnerabilities with zero config
Most security tools make you write config before you get a single result. Draugr scans a repo with no descriptor at all: draugr scan . runs SAST, SCA, secret and IaC checks over your code and ranks what it finds. Nothing to write first.