DEV Community

#devsecops

Integrating security practices into the DevOps lifecycle.

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Marketing Pages Rot Silently. Mine Print an Expiry Date on Every Claim.

Marketing Pages Rot Silently. Mine Print an Expiry Date on Every Claim.

1
Comments
8 min read
L3: I built continuous runtime monitoring because certification is point-in-time, attacks are runtime

L3: I built continuous runtime monitoring because certification is point-in-time, attacks are runtime

Comments 3
2 min read
Mini Shai-Hulud: the tj-actions memory-dump script, reused fourteen months later

Mini Shai-Hulud: the tj-actions memory-dump script, reused fourteen months later

Comments
2 min read
Sample Size and Statistical Power: What a Small Sample Can and Cannot Tell You

Sample Size and Statistical Power: What a Small Sample Can and Cannot Tell You

Comments
8 min read
The CWE Taxonomy, Explained: A Name Is Not a Verdict

The CWE Taxonomy, Explained: A Name Is Not a Verdict

Comments
8 min read
Reproducibility vs Replicability: Why Benchmark Numbers Need Both

Reproducibility vs Replicability: Why Benchmark Numbers Need Both

Comments
7 min read
Static Analysis vs. SAST vs. Linting: The Taxonomy That Matters for Security Teams

Static Analysis vs. SAST vs. Linting: The Taxonomy That Matters for Security Teams

Comments
8 min read
CVSS Scores Explained: The Number Measures Severity, Not Risk

CVSS Scores Explained: The Number Measures Severity, Not Risk

Comments
8 min read
Ground Truth in Security Testing: Who Decides What's Vulnerable?

Ground Truth in Security Testing: Who Decides What's Vulnerable?

Comments
8 min read
Proxy Metrics: The Number You Optimize Is Not the Thing You Want

Proxy Metrics: The Number You Optimize Is Not the Thing You Want

Comments
8 min read
The Confusion Matrix: What TP, FP, FN, and TN Actually Mean

The Confusion Matrix: What TP, FP, FN, and TN Actually Mean

Comments
8 min read
Ranking vs. Measuring: What a Leaderboard Throws Away

Ranking vs. Measuring: What a Leaderboard Throws Away

Comments
8 min read
OWASP Top 10, Explained: An Address System, Not a Severity Scale

OWASP Top 10, Explained: An Address System, Not a Severity Scale

Comments
8 min read
Fixtures First, Rules Second: How to Design a Ground-Truth Corpus

Fixtures First, Rules Second: How to Design a Ground-Truth Corpus

1
Comments
9 min read
Composite Scores and Weighting: Your 'Overall Score' Is an Editorial

Composite Scores and Weighting: Your 'Overall Score' Is an Editorial

Comments
8 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.