An IRAP Report Travels. The Risk Decision Does Not.
An IRAP assessment is evidence for a security decision, not a certification. Why scope, deployment and the consuming agency's own risk decision matter when you reuse assessment results.
The AppGenie Blog
Controlled AI-assisted delivery, DevSecOps and compliance engineering, written from inside environments where somebody eventually has to answer for the outcome. 98 posts and counting.
All (98)
DevSecOps (12)
AI Technology (11)
Copado (9)
FTP2SF (9)
Salesforce (9)
AI (8)
Compliance (5)
Engineering Governance (3)
Growth (3)
Infrastructure (3)
Release Management (3)
Security (3)
showing the 12 most-used of 76 topics
A Green Copado Job Is Not an Audit Trail
How Copado Job Steps, Results and Job Executions contribute to a defensible audit trail, and why exporting raw records to Splunk is not enough on its own.
Connecting Your CMS to Salesforce Is Not the Same as Moving It There
What Salesforce CMS Connect actually provides, where external CMS integration falls short of expectations, and how to test whether it fits your Experience Cloud architecture.
Half Your Business Is Built to Check the Other Half
A policy is a document that gets read once by a committee, signed off, and brought out during the post-implementation review when somebody needs to establish whose fault it was. On its own it does nothing, because intent has never stopped anybody. Most of the checking layer in a large organisation exists because somebody wrote down a rule and never built the thing that would make it true.
Defining a Copado Story for Script Deployment
How do you raise a Copado user story when there is no metadata to deploy, only a script that has to run? The story is still the unit of work. Commit the script to the story branch, let a Function or a manual task execute it, and keep the evidence inside the pipeline where it belongs.
Understanding Copado Functions for Efficient Deployment
Copado Functions are easy to build and easy to waste. Every execution is a metered container, so the image you pick, the worker you size and the number of times you invoke it are all cost decisions. This is the operating view rather than the build guide.
The Data Centre That Leaves Earth
Google has put an actual spacecraft behind orbital AI compute. The interesting question is not whether a TPU survives launch, it is whether a formation of solar-powered satellites connected by lasers can behave like a data centre. If it can, the first interplanetary civilisation will not announce itself. It will look like a business decision.
Betting $400 Billion on the Weather
The AI infrastructure trade has quietly become a bet on transmission, transformers and construction schedules. Oracle is the clearest case because its numbers make the physical and financial relationship legible. You do not need an AI winter to make the model creak, you just need the grid to behave like an old grid.
The AI Can Clean Up 60,000 Feature Flags. That Doesn't Make 60,000 Feature Flags Good Engineering.
DoorDash built a multi-agent LLM system to clean up stale feature flags across 623 repositories. The engineering is genuinely clever. The question nobody asks is why a temporary construct became a population of 60,000. A runtime switch is a migration path or an executable path, and only one of them is allowed to survive.
You Did Not Write Most of Your Software. Can You List It?
Google publishes two billion lines of its own code, but the number that should worry you is how little of your product you wrote. Vulnerability submissions rose 263 per cent, NIST has stopped enriching all of them, and mean time to exploit is now negative. What an SBOM is, what one actually looks like, and why a filed one is worthless.
Time-to-Market Is Not the Same Thing as Quality-to-Market
Microsoft shipped fixes for the better part of a thousand vulnerabilities in a single Patch Tuesday, including two already being exploited. That is not a story about Microsoft. It is what an industrial-scale problem discovery mechanism looks like, and it exposes the fact that we have spent thirty years measuring how fast we ship and never once measuring the quality of what arrived.
We Stopped Making the Browser Wait for the Backend
Five years of running FTP2SF in production showed us that the Lambda layer did not need to carry every byte. Where the provider supports it the browser now streams directly against a signed, narrowly scoped transfer, while Lambda keeps control of authentication, authorisation and orchestration. Plus what we did with the move from Aura to LWC.