Product UpdatesJul 10, 2026Know the Compliance Impact Before the Pull Request MergesJudge maps a pull request to the compliance controls and framework criteria its code changes can affect, before merge.By TestifySec EngineeringRead More →
Supply ChainApr 2, 2026Preventing the Claude Code Leak with Attestation PoliciesAnthropic accidentally shipped 512,000 lines of source code in an npm package. A single Rego policy on the build step would have caught it. Here's the proof.By Cole KennedyRead More →
Supply ChainMar 25, 2026CI/CD Isolation: The One Architecture Decision That Protects Your High-Value SecretsMost CI/CD pipelines hand production credentials to code that hasn't been reviewed yet. Here's how separating CI from CD eliminates the largest class of secret exfiltration attacks — with real examples from our own infrastructure.By Cole KennedyRead More →
Supply ChainMar 24, 2026A .pth File, 34KB of Base64, and Every Secret You HaveThe LiteLLM PyPI compromise planted a credential stealer that runs on Python startup — no import required. Here is how cilock catches the same attack pattern in CI/CD pipelines.By Cole KennedyRead More →
Supply ChainMar 21, 202675 Poisoned Tags and Nobody Noticed: How cilock-action Kills CI/CD Supply Chain AttacksAttackers compromised trivy-action by repointing 75 version tags. The fix isn't just SHA pinning. It's wrapping every CI step in cryptographic attestation that proves what actually ran.By Cole KennedyRead More →
ComplianceMar 20, 2026Your Compliance Evidence Is Probably Fiction. Here's How to Know.A recent investigation exposed a compliance vendor fabricating hundreds of audit reports. We use AI agents to find evidence, not create it. That's the difference between GRC and GRC on autopilot.By Cole KennedyRead More →
DevSecOpsJan 14, 2026Claude Code Hooks: Automated Guardrails for AI-Assisted DevelopmentBuild automated guardrails for AI-assisted development with Claude Code Hooks. Learn about blocking, prompting, and notification hooks with practical bash examples.By TestifySec EngineeringRead More →
ComplianceDec 10, 2025Beyond "Trust Me, We Ran the Security Scan": Cryptographic Evidence for ComplianceTransform your security scans from mutable logs into cryptographic evidence that satisfies auditors and automates compliance.By Cole KennedyRead More →
Supply ChainDec 8, 2025Modern Software Is Assembled, Not Written: Proving Component ProvenanceFrom npm packages to AI-generated code, modern software is assembled from components. Learn how to cryptographically prove where every piece came from.By Cole KennedyRead More →