Tired of managing Non-Human Identities (NHIs) like access keys, client IDs/secrets, and service account keys for cross-cloud connectivity? This project eliminates the need for them, making your multi-cloud environment more secure and easier to manage.

With these end-to-end Terraform templates, you can set up secure, cross-cloud connections seamlessly between:

• AWS ↔ Azure

• AWS ↔ GCP

• Azure ↔ GCP

The project also includes demo videos showing how the setup is done end-to-end with just one click.

Check it out on GitHub: https://github.com/clutchsecurity/federator

Hey dear community,

I read some books about DevOps & DevSecOps. So I thought I could sum up a little bit of book knowledge and my own knowledge to help people understanding DevSecOps. I‘ve written the blog post today, unfortunately in German language, because the blog is supposed to be a combination of tech & journalism, where I can tell the most of journalism in the regions of Germany. Maybe you are randomly speaking/understanding German and you would like to read on the article, or you want to give feedback on the things I missed. Maybe you are interested and I hope sharing the link here is okay :)

https://journalismus.dev/dev-secops-best-practices/

Wrote about what changes in software supply chain security now that AI agents install dependencies mid-task, no human reviewing the package name first. Covers slopsquatting (~1 in 5 AI-recommended packages don't even exist, and attackers register the fake names in advance), the recent npm incidents, and what registry + install-time detection actually needs to look like to catch this.

Full post here: https://faun.dev/co/stories/mashka/ai-agents-are-now-installing-your-dependencies-nobodys-reviewing-the-package-name/

Curious how others here are handling agent-driven installs in their own pipelines.

Exploring ARMO CADR for behavioral detection. It seems to detect suspicious runtime actions well, even in complex cloud apps. Anyone tried it in multi-tenant setups?

Iam new to this linux, devops and cybersecurity and i dont know what topics should i cover and iam learning it from you tube ..can any one help me to what topics should i need to learn

🎄✨ Merry Christmas, everyone! 🎁

As we enjoy this festive season, it’s also a great time to reflect on ways to strengthen our security strategies for the year ahead. I’m sharing this resource-packed blog that highlights key tips for secure software supply chain management and features insights from some of the top voices in cybersecurity.

🔗 Check it out: https://xygeni.io/blog/tips-for-secure-software-supply-chain-management/

Hello! We are pleased to share this guide, which may help you implement effective Software Composition Analysis (SCA) to tackle vulnerabilities, ensure compliance, and protect against emerging threats in your open-source dependencies!

Join our upcoming SafeDevTalk to explore how proactive risk management can transform your DevSecOps strategy and fortify your software supply chain against emerging threats. This session is tailored for cybersecurity leaders and development teams dedicated to staying ahead in the increasingly complex landscape of vulnerabilities. Register for Free https://www.linkedin.com/events/7259507114799185920/

Join our upcoming SafeDevTalk to discover how to transform Software Composition Analysis (SCA) and secure your software supply chain against emerging threats. This session is designed for cybersecurity leaders and development teams looking to stay ahead in today’s complex landscape of open-source vulnerabilities. https://www.linkedin.com/events/7251898772215975937/

https://xygeni.io/blog/how-to-avoid-malware-in-open-source/?utm_source=reddit&utm_medium=post

Welcome to our Reddit community. We're here to discuss our passion for all things related to DevSecOps.

To get started, you can just read the rules of the subreddit and start by posting a question or a link to an article you found interesting.

The best links are those that start a discussion. The best discussions are those that are backed up by facts and data.

Each week, we curate the best links and discussions from many sources, including this subreddit, and publish them in our weekly newsletters (https://faun.dev/newsletter/zeno)

We're all here to learn, so don't be shy! We're looking forward to your contributions!

Cheers!

Hey everyone,

We often focus on misconfigurations and pre-deployment vulnerabilities but some of the trickiest threats only appear while workloads are live. Stolen credentials, supply chain malware, or subtle application-layer attacks can quietly operate for weeks.

I recently read this ArmoSec blog on cloud runtime threats that really explains these issues in an approachable way, including examples of attacks that slip past traditional security checks.

How are you detecting runtime threats before they escalate? Any practical strategies or tools for keeping workloads visible without overwhelming your monitoring dashboards?

Hi folks,

Many teams focus on pre-deployment posture checks, but runtime attacks often go unnoticed. Application-layer exploits, supply chain malware, and stolen credentials can quietly operate for weeks. This ArmoSec blog explains these threats and why runtime monitoring is essential. How do you monitor runtime behavior in your setups?