Governance infrastructure for the age of AI
Worldwide
Joined May 2023
- Tweets59
- Following3
- Followers39
- Likes21
Chainloop retweeted
Today we open-sourced our collector for AI coding sessions.
We built @chainloop_dev as the governance layer for an automated SDLC. Since then, the industry is quickly evolving to the agentic SDLC; the foundational premise is the same, but the scale and surface have changed.
Chainloop retweeted
Our engineers turned a codebase's own security-fix history into a map of where its next bug is likely to be. Worth reading if you run an AppSec program and your scanners only find known CVEs.
chainloop.dev/blog/predictin…
Chainloop retweeted
We are testing Jev from @typesafeai at @chainloop_dev for security classification, and the results are better than I expected.
The task is simple to explain. Go through the full commit history of a repo and ask one question per commit: was this a security fix? Then classify the vulnerability and give a confidence score. This is how we build the AI Security Context for every connected repo at Chainloop.
Why is this useful? (more in our docs, linked in the comments)
1. Find regressions and first-party vulnerabilities with adversarial analysis. Your AI agents get this context when they write code, so they know where the codebase got burned before and can hunt for unpatched variants of old bugs.
2. Measure the security hygiene of a project over time. Every confirmed fix is dated and classified, so you get an honest record: how fast you patch, how long bugs stayed exposed, which classes keep coming back.
3. Audit evidence. That record holds up in audits and security reviews, and it is a good way to judge a codebase before you depend on it.
DM me if you want to try it.
ps. Policies are next. Most of our agentic policies are the same problem anyway: here is the evidence, here is the question, give me a verdict with a reason and a score.
Chainloop retweeted
A month of AI-driven audits against @chainloop_dev’s codebase found serious bugs that had passed review, tests, and CI.
We fixed them and documented the experiment: bit.ly/3TcSEhh
#AppSec #AISecurity
Chainloop retweeted
this is one of the reasons why cyber-security concerns around AI get it completely wrong
human-slop code is full of so many security problems its mind blowing... most people have no idea just how bad it is
the same LLMs that can be used to find them by bad guys can be used by vendors to patch them proactively and patch them before they're exploited
A month of AI-driven audits against @chainloop_dev’s codebase found serious bugs that had passed review, tests, and CI.
We fixed them and documented the experiment: bit.ly/3TcSEhh
#AppSec #AISecurity
Chainloop retweeted
🚀 The new @chainloopHQ major version is now available in the Bitnami catalog!
A CNCF project to secure software supply chains with in-toto attestations, ready to deploy via containers and Helm charts.
🔐 Need FedRAMP compliance with FIPS, STIG? Check 👉 vmware.com/products/app-plat…
Chainloop retweeted
At @chainloopHQ we've made solid progress on foundational components like Policies or visibility with Prometheus 🔥 and @grafana 🚀
Also, on solidifying our on-prem/SaaS offerings with our work on SOC-2, FIPS, and air gap environments support 🤓 chainloop.dev/blog/chainloop…
Chainloop retweeted
Welcome to the team!
chainloop.dev/blog/welcoming…
Chainloop retweeted
We will be at #RSAC in San Francisco (May 6 - 9), an opportunity for you to see a demo of the upcoming @chainloopHQ Platform. We would love to discuss software supply chain security and get your insights. Contact us if you are interested or know someone who would be!
Chainloop retweeted
Chainloop was born open source, and today, we are reaffirming our commitment by joining @openssf. This will propel our mission of helping developers ship trusted software faster.
github.com/chainloop-dev/cha…
🎉 While the OpenSSF gathers to celebrate innovation and collaboration, at SOSS Community Day North America, we're happy to share some incredible updates from our growing community! 🎉
Check out our latest press release.
hubs.la/Q02sV4X20
#SOSSCommunity
Chainloop retweeted
Thanks to everyone who came to our talk at 3PM on Friday at @KubeCon_
The recording is not up yet, but in the meantime, check out our project and send feedback and comments!
github.com/chainloop-dev/cha…
Chainloop retweeted
Starting in 1 hour - Live demos from @matiaspan26, @lmarsden, @gerhardlazu, and @chainloopHQ on the Dagger Community Call. See you there!
dagger-io.zoom.us/webinar/re…
Chainloop retweeted
GitOps support is finally here in our latest @chainloopHQ release github.com/chainloop-dev/cha… 🚀
Chainloop retweeted
YC changed my life, literally. It gave our startup the chance we deserved. Because of it, I moved to the US and met incredible people, and among them the most important one, my wife :)
Go and apply; it's definitely worth it!
At YC, we work with founders throughout the life of their startup and beyond, to build the world-changing companies of the future.
And we'd love to work with you.
The deadline to apply for YC W24 is this Friday, Oct 13 at 8pm PDT — apply today at ycombinator.com/apply.
Chainloop retweeted
and yes, you'll indeed have content addressable attestations soon with @chainloopHQ :) github.com/chainloop-dev/cha…
Chainloop retweeted
The stickers season has officially begun!
Meet us in person next week in Bilbao!
The Chainloop team is coming to Bilbao for Open Source Summit Europe and @openssf Day EU next week. Want to meet us? Just drop us a DM or book some time here cal.com/chainloop-bilbao-202…
Chainloop retweeted
It's great to see new early adopters and contributors!
The past two months have been incredibly busy, and there will be more news to share soon. For now, please check out the latest Chainloop release.
Every Chainloop release is important, but this one is special.
We are excited to see external contributions to fit their deployment needs. Thanks to them, deploying Chainloop in GKE is better than ever!
github.com/chainloop-dev/cha…
Chainloop retweeted
@migmartri from chainloop.dev contributed a CLI additions to exercise our GCS collector, and used it for some cool integration with their tool that they talk more about at
chainloop.dev/blog/introduci… 7/n
Chainloop retweeted
We are excited to see @chainloopHQ in the @IDC's first Software Supply Chain Security Market Glance. We are covered in the "Chain of Custody" category and I can't wait to explore new territories. Congrats @KatieDNorton1 and @JimBMercer.
This Post is from an account that no longer exists. Learn more