Software engineering
Everything I've written on software engineering, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
Can You Trust a Signed Webhook to Update a Business Record?
Review webhook trust beyond signatures: tenant binding, replay, duplicate effects, event ordering and recovery after missed notifications.
-
Does the Vulnerable Component in Your SBOM Affect Your Service?
Trace an SBOM vulnerability match to deployed software, affected versions, execution paths and VEX evidence before closing or escalating the finding.
-
How Do You Verify Data Deletion Across Backups and Vendors?
Verify data deletion across replicas, object versions, backups and vendors with scoped evidence, recovery tests, key checks and honest retention reporting.
-
When Should Security Evidence Block a Green Software Release?
Decide whether a green build is ready to ship by checking test execution, security claims, contradictory evidence, exceptions and release scope.
-
A security review developers don't dread
If the security review happens at the end, it's a gate, and gates get argued with. If it happens at the start, it's a design conversation, and design convers...
-
API engineering
I would not begin API engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
An SBOM Is an Inventory. It Isn't Proof Your Software Is Safe.
There's a familiar move in technology procurement: take something genuinely useful, turn it into a checkbox, and then quietly start treating the checkbox as ...
-
CI/CD security
I would not begin CI/CD security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Code maintainability
I would not begin code maintainability by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Developer security education
I would not begin developer security education by buying another platform or launching a large programme. I would find the boundary, the accountable owner, a...
-
Distributed systems reliability
I would not begin distributed systems reliability by buying another platform or launching a large programme. I would find the boundary, the accountable owner...
-
Linux hardening
I would not begin Linux hardening by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
Observability engineering
I would not begin observability engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Python automation
I would not begin Python automation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Secure architecture
I would not begin secure architecture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Secure software deployment
I would not begin secure software deployment by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
Nothing matches. Try another word, or ask me directly.