Controlled AI-assisted delivery, DevSecOps and compliance engineering, written from inside environments where somebody eventually has to answer for the outcome. 11 posts and counting.
A policy is a document that gets read once by a committee, signed off, and brought out during the post-implementation review when somebody needs to establish whose fault it was. On its own it does nothing, because intent has never stopped anybody. Most of the checking layer in a large organisation exists because somebody wrote down a rule and never built the thing that would make it true.
Copado Functions are easy to build and easy to waste. Every execution is a metered container, so the image you pick, the worker you size and the number of times you invoke it are all cost decisions. This is the operating view rather than the build guide.
DoorDash built a multi-agent LLM system to clean up stale feature flags across 623 repositories. The engineering is genuinely clever. The question nobody asks is why a temporary construct became a population of 60,000. A runtime switch is a migration path or an executable path, and only one of them is allowed to survive.
Google publishes two billion lines of its own code, but the number that should worry you is how little of your product you wrote. Vulnerability submissions rose 263 per cent, NIST has stopped enriching all of them, and mean time to exploit is now negative. What an SBOM is, what one actually looks like, and why a filed one is worthless.
Microsoft shipped fixes for the better part of a thousand vulnerabilities in a single Patch Tuesday, including two already being exploited. That is not a story about Microsoft. It is what an industrial-scale problem discovery mechanism looks like, and it exposes the fact that we have spent thirty years measuring how fast we ship and never once measuring the quality of what arrived.
Plenty of firms will audit your pipelines and tell you your release process is a liability, while running build pipelines of their own that would not survive the same review. So here are ours with the actual numbers: 21 deployments averaging 82 lines, 29 shared templates, 14 gates that fail the build, and the one that sat written but unwired for weeks.
DevSecOps and IRAP. Recent cyber events have focused attention on what many organisations are doing wrong. Here's a checklist to make sure you are aligning your DevSecOps with IRAP requirements and protecting your business.
Comparing Salesforce DevOps platforms: DevOps Center, Copado, Azure DevOps, Flosum and AutoRABIT, with their strengths, to help you choose the right fit.
Authenticating with your SF CLI is fine when you can use a screen and keyboard, but what about your Pipeline? Read the step-by-step How to use JWT to access your Salesforce Instance.
Why Git merges go wrong and how to fix them: how merging works, how to resolve merge conflicts calmly, and how to recover when it all goes sideways.
Static code analysis is only half the answer to Salesforce security. A CRUD violation flagged by S4 shows why pull requests and good patterns matter too.
