governance
5 posts · all writing
The VEX analysis your supplier already did
Your supplier already worked out which CVEs do not apply. Reading their VEX beats retyping it, and that supplier is often the platform team down the hall.
CIS benchmarks are somebody else's checklist
A benchmark flags things you chose deliberately. The value is not the score, it is the short list you decided not to meet and the record of who decided.
The ignore file is where security programs go to die
Every scanner ships a way to make findings disappear. Risk acceptance is fine; losing who accepted it, why, and until when is what kills the program.
The license nobody gated on: copyleft in your tree
A CVE is embarrassing and fixable. A copyleft obligation you shipped for two years is neither, and you find out during due diligence. How to gate on it.
Your CI logs are not evidence
A screenshot of a green build will not survive the follow-up: which version, which checks, against what data, and would it answer the same way twice.