sarif
3 posts · all writing
Your CI logs are not evidence
A screenshot of a green build will not survive the follow-up: which version, which checks, against what data, and would it answer the same way twice.
Security findings in your editor, from standard SARIF
A finding you have to go looking for is one you fix later. Draugr writes standard SARIF, so a scan opens as inline squiggles in VS Code with no plugin.
Describe your app, not your scanners
Teams wire up scanners instead of describing software, and it breaks at scale. One declarative descriptor covers Trivy, Semgrep and Gitleaks at once.