DevSecOps Podcast
Security used to be the team that said no at the end; DevSecOps is the bet that you can move fast and not get owned, by building the guardrails into the pipeline instead of bolting them on afterward. The episodes here dig into the supply chain you didn't know you had: dependency and build-system attacks, leaked credentials, and the CVEs that turn a quiet Tuesday into an all-hands.
We focus on the operational reality of shipping secure software — scanning that surfaces real issues instead of drowning teams in noise, secrets management that survives contact with developers, and zero-trust and SBOM work that's more than a compliance checkbox. If you're trying to make security a property of how you deploy rather than a gate sitting in front of it, start here.
Episodes on DevSecOps
Kiro CLI Approval Bypass, Amazon Braket Pickle Risk, AWS Org Logging, KEDA Upgrades, and Automation’s Hidden BoundariesEpisode: Kiro CLI Approval Bypass, Amazon Braket Pickle Risk, AWS Org Logging, KEDA Upgrades, and Automation’s Hidden BoundariesThis episode of Ship It Weekly is about automation’s hidden boundaries. Brian covers Kiro CLI CVE-2026-9255, where piped stdin could act like user approval, Amazon Braket SDK CVE-2026-9291…
GitHub Supply Chain Attacks, Railway’s GCP Outage, Discord’s Voice Failure, AWS Retry Changes, and Trusted Tool RiskEpisode: GitHub Supply Chain Attacks, Railway’s GCP Outage, Discord’s Voice Failure, AWS Retry Changes, and Trusted Tool RiskThis episode of Ship It Weekly is about trusted tools becoming production dependencies. Brian covers a rough GitHub supply chain week, including the compromised Nx Console VS Code…
Ship It Conversations: Jake Warner on Cycle.io, Bare Metal’s Comeback, and Why Private Cloud Is Getting Interesting AgainEpisode: Ship It Conversations: Jake Warner on Cycle.io, Bare Metal’s Comeback, and Why Private Cloud Is Getting Interesting AgainThis is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.In this Ship It: Conversations episode, I talk with Jake Warner, founder and…
CISA’s GitHub Leak, AI Root Cause Analysis, Copilot Agents, Claude Code in CI/CD, and Kubernetes Seccomp RiskEpisode: CISA’s GitHub Leak, AI Root Cause Analysis, Copilot Agents, Claude Code in CI/CD, and Kubernetes Seccomp RiskThis episode of Ship It Weekly is about secrets, agents, risky defaults, and follow-up work that never gets done. Brian covers the CISA contractor GitHub leak involving AWS…
AI Agents Get API Access and Identity: GitHub Copilot Cloud Agents, MCP Auth, Ansible Automation, OpenAI Daybreak, and the New Production RiskEpisode: AI Agents Get API Access and Identity: GitHub Copilot Cloud Agents, MCP Auth, Ansible Automation, OpenAI Daybreak, and the New Production RiskThis episode of Ship It Weekly is about AI agents moving from helpful coding assistants into real operational actors. Brian covers GitHub making Copilot cloud agent tasks available…
Cursor Deletes PocketOS Prod DB, .de DNSSEC Outage, Bluesky Postmortem, Argo CD, and Copy FailEpisode: Cursor Deletes PocketOS Prod DB, .de DNSSEC Outage, Bluesky Postmortem, Argo CD, and Copy FailThis episode of Ship It Weekly is about modern reliability getting squeezed from both directions. Old-school failures still hit hard, like broken DNSSEC, kernel privilege escalation bugs, and…
Ship It Conversations: Gareth Kersey on IaCConf 2026, AI, and Corey Quinn’s Terraform KeynoteEpisode: Ship It Conversations: Gareth Kersey on IaCConf 2026, AI, and Corey Quinn’s Terraform KeynoteThis is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.This episode is not sponsored. I wanted to cover IaCConf because the theme…
GitHub RCE, AI Agent Prompt Injection, and the New Reality: Your Developer Toolchain Is Production NowEpisode: GitHub RCE, AI Agent Prompt Injection, and the New Reality: Your Developer Toolchain Is Production NowThis episode of Ship It Weekly is about the developer toolchain becoming part of production. Brian covers GitHub’s critical git push RCE, AI-assisted reverse engineering, prompt injection against…
Kubernetes 1.36, Gateway API v1.5, AWS Copilot End of Support, and Cloudflare Non-Human IdentitiesEpisode: Kubernetes 1.36, Gateway API v1.5, AWS Copilot End of Support, and Cloudflare Non-Human IdentitiesThis episode of Ship It Weekly is about platforms getting sharper about defaults, ownership, and the old paths they are no longer willing to quietly carry forever. Brian…
AWS Interconnect GA, Cloudflare Mesh, GitLab 19, EKS Auto Mode, and OpenTelemetry ConfigEpisode: AWS Interconnect GA, Cloudflare Mesh, GitLab 19, EKS Auto Mode, and OpenTelemetry ConfigThis episode of Ship It Weekly is about networking, ingress, and private access moving further up into the platform layer. Brian covers AWS Interconnect going generally available, Cloudflare…
Special: Claude Mythos Preview and Project Glasswing: AI Exploit Discovery, Zero-Day Risk, Business Fallout, and What It Means for DevOps, Cloud, and Platform SecurityEpisode: Special: Claude Mythos Preview and Project Glasswing: AI Exploit Discovery, Zero-Day Risk, Business Fallout, and What It Means for DevOps, Cloud, and Platform SecurityIn this Ship It Weekly special, Brian breaks down Claude Mythos Preview and Project Glasswing, and why this story matters beyond normal AI launch hype.Anthropic is treating Mythos…
Amazon S3 Files, Malicious npm Plugins, Trivy Fallout, and Kubernetes’ Gateway ShiftEpisode: Amazon S3 Files, Malicious npm Plugins, Trivy Fallout, and Kubernetes’ Gateway ShiftThis episode of Ship It Weekly is about the interface layer becoming the story. Brian covers Amazon S3 Files and why it feels more like a managed filesystem…
GitHub Actions Hardening, Airbnb Config Rollouts, Cloudflare Rust Restarts, ECS Managed Daemons, and Terraform Access ControlsEpisode: GitHub Actions Hardening, Airbnb Config Rollouts, Cloudflare Rust Restarts, ECS Managed Daemons, and Terraform Access ControlsThis episode of Ship It Weekly is about the quiet platform work that keeps things safe before they break. Brian covers GitHub Actions hardening in Kubernetes-related repos, Airbnb’s…
Hackerbot-Claw Grows, Xygeni Tag Poisoning, GitHub Search HA, Windows SID Failures, and AI Skills Supply ChainEpisode: Hackerbot-Claw Grows, Xygeni Tag Poisoning, GitHub Search HA, Windows SID Failures, and AI Skills Supply ChainThis episode of Ship It Weekly is about the places where convenience quietly turns into trust.Brian revisits the Trivy story by zooming out to the bigger hackerbot-claw GitHub…
McKinsey AI Flaw, Kafka Goes Diskless, Google Buys Wiz, AWS Copilot Ends, and AI Gateway on KubernetesEpisode: McKinsey AI Flaw, Kafka Goes Diskless, Google Buys Wiz, AWS Copilot Ends, and AI Gateway on KubernetesThis week on Ship It Weekly, Brian looks at what happens when new interfaces create old responsibilities.McKinsey patched a vulnerability in its internal AI tool Lilli, Kafka contributors…
Meta Buys Moltbook, Block AI Layoffs Get Messier, Atlassian Cuts Jobs, and GitHub Explains the OutagesEpisode: Meta Buys Moltbook, Block AI Layoffs Get Messier, Atlassian Cuts Jobs, and GitHub Explains the OutagesThis week on Ship It Weekly, Brian covers five “AI meets reality” stories that every DevOps, SRE, security, and platform team can learn from.Block’s AI layoff story is…
Ship It Conversations: Yvonne Young on Linux Foundations, Mentorship, and Getting Job Ready in CloudEpisode: Ship It Conversations: Yvonne Young on Linux Foundations, Mentorship, and Getting Job Ready in CloudThis is a guest conversation episode of Ship It Weekly (separate from the weekly news recaps).In this Ship It: Conversations episode I talk with Yvonne Young, a cloud…
AWS Bahrain/UAE Data Center Issues Amid Iran Strikes, ArgoCD vs Flux GitOps Failures, GitHub Actions Hackerbot-Claw Attacks (Trivy), RoguePilot Codespaces Prompt Injection, Block “AI Remake” Layoffs, Claude Code SecurityEpisode: AWS Bahrain/UAE Data Center Issues Amid Iran Strikes, ArgoCD vs Flux GitOps Failures, GitHub Actions Hackerbot-Claw Attacks (Trivy), RoguePilot Codespaces Prompt Injection, Block “AI Remake” Layoffs, Claude Code SecurityThis week on Ship It Weekly, Brian looks at how the boundary of ops keeps expanding.We cover AWS flagging issues in Bahrain/UAE amid Iran strikes, ArgoCD vs Flux…
Cloudflare BYOIP BGP Withdrawals, Clerk’s Postgres Query-Plan Flip Outage, and AWS Kiro Permissions Lessons (Grafana Privesc + runc CVEs)Episode: Cloudflare BYOIP BGP Withdrawals, Clerk’s Postgres Query-Plan Flip Outage, and AWS Kiro Permissions Lessons (Grafana Privesc + runc CVEs)This week on Ship It Weekly, Brian looks at how the boundary of ops keeps expanding.We cover AWS flagging issues in Bahrain/UAE amid Iran strikes, ArgoCD vs Flux…
Special: OpenClaw Security Timeline and Fallout: CVE-2026-25253 One-Click Token Leak, Malicious ClawHub Skills, Exposed Agent Control Panels, and Why Local AI Agents Are a New DevOps/SRE Control Plane (OpenAI Hires Founder)Episode: Special: OpenClaw Security Timeline and Fallout: CVE-2026-25253 One-Click Token Leak, Malicious ClawHub Skills, Exposed Agent Control Panels, and Why Local AI Agents Are a New DevOps/SRE Control Plane (OpenAI Hires Founder)In this Ship It Weekly special, Brian breaks down the OpenClaw situation and why it’s bigger than “another CVE.”OpenClaw is a preview of what platform teams are about…
When guardrails break prod: GitHub “Too Many Requests” from legacy defenses, Kubernetes nodes/proxy GET RCE, HCP Vault resilience in an AWS regional outage, and PCI DSS scope creepEpisode: When guardrails break prod: GitHub “Too Many Requests” from legacy defenses, Kubernetes nodes/proxy GET RCE, HCP Vault resilience in an AWS regional outage, and PCI DSS scope creepThis week on Ship It Weekly, Brian hits four stories where the guardrails become the incident.GitHub had “Too Many Requests” caused by legacy abuse protections that outlived their…
Azure VM Control Plane Outage, GitHub Agent HQ (Claude + Codex), Claude Opus 4.6, Gemini CLI, MCPEpisode: Azure VM Control Plane Outage, GitHub Agent HQ (Claude + Codex), Claude Opus 4.6, Gemini CLI, MCPThis week on Ship It Weekly, Brian hits four “control plane + trust boundary” stories where the glue layer becomes the incident.Azure had a platform incident that impacted…
CodeBreach in AWS CodeBuild, Bazel TLS Certificate Expiry Breaks Builds, Helm Charts Reliability Audit, and New n8n Sandbox Escape RCEEpisode: CodeBreach in AWS CodeBuild, Bazel TLS Certificate Expiry Breaks Builds, Helm Charts Reliability Audit, and New n8n Sandbox Escape RCEThis week on Ship It Weekly, Brian looks at four “glue failures” that can turn into real outages and real security risk.We start with CodeBreach: AWS disclosed a…
curl Shuts Down Bug Bounties Due to AI Slop, AWS RDS Blue/Green Cuts Switchover Downtime to ~5 Seconds, and Amazon ECR Adds Cross-Repository Layer SharingEpisode: curl Shuts Down Bug Bounties Due to AI Slop, AWS RDS Blue/Green Cuts Switchover Downtime to ~5 Seconds, and Amazon ECR Adds Cross-Repository Layer SharingThis week on Ship It Weekly, Brian looks at three different versions of the same problem: systems are getting faster, but human attention is still the bottleneck.We start…
n8n Auth RCE (CVE-2026-21877), GitHub Artifact Permissions, and AWS DevOps Agent LessonsEpisode: n8n Auth RCE (CVE-2026-21877), GitHub Artifact Permissions, and AWS DevOps Agent LessonsThis week on Ship It Weekly, the theme is simple: the automation layer has become a control plane, and that changes how you should think about risk.We start…
n8n Critical CVE (CVE-2026-21858), AWS GPU Capacity Blocks Price Hike, Netflix TemporalEpisode: n8n Critical CVE (CVE-2026-21858), AWS GPU Capacity Blocks Price Hike, Netflix TemporalThis week on Ship It Weekly, Brian’s theme is basically: the “automation layer” is not a side tool anymore. It’s part of your perimeter, part of your reliability…
Ship It Conversations: From Full-Stack to Cloud/DevOps, One Project at a Time (with Eric Paatey)Episode: Ship It Conversations: From Full-Stack to Cloud/DevOps, One Project at a Time (with Eric Paatey)This is a guest conversation episode of Ship It Weekly (separate from the weekly news recaps).I sat down with Eric Paatey, a Cloud & DevOps Engineer who’s been…
Ship It Conversations: The WHY Behind DevOps, Upskilling, and Agentic AI (with Maz Islam)Episode: Ship It Conversations: The WHY Behind DevOps, Upskilling, and Agentic AI (with Maz Islam)This is a Ship It Weekly conversation episode. The weekly news recaps are still weekly. These interviews drop in between when I find someone worth talking to and…
GitHub Runner Pricing Pause, Terraform Cloud Limits, and AI in CIEpisode: GitHub Runner Pricing Pause, Terraform Cloud Limits, and AI in CIThis week on Ship It Weekly, Brian looks at how the “platform tax” is showing up everywhere: pricing model shifts, CI dependencies, and new security boundaries thanks to…
IBM Buys Confluent, React2Shell, and Netflix on AuroraEpisode: IBM Buys Confluent, React2Shell, and Netflix on AuroraIn this episode of Ship It Weekly, Brian powers through a cold and digs into a very “infra grown-up” week in DevOps.First up, IBM is buying Confluent for…
Kubernetes Config Reality Check, EKS Control Planes, and GitHub GuardrailsEpisode: Kubernetes Config Reality Check, EKS Control Planes, and GitHub GuardrailsIn this episode of Ship It Weekly, Brian digs into what’s new for people actually running infra: Kubernetes config, EKS control planes and networking, and GitHub’s latest CI/CD…
Special: When the Cloud Has a Bad Day: Cloudflare, AWS us-east-1 & GitHub OutagesEpisode: Special: When the Cloud Has a Bad Day: Cloudflare, AWS us-east-1 & GitHub OutagesIn this special kickoff episode of Ship It Weekly, Brian walks through three major outages from the last few weeks and what they actually mean for DevOps, SRE,…
Subscribe to Ship It Weekly
New episodes weekly on every major platform
From the newsroom
Prefer to read? On Call Brief is our weekly operator news digest.
Frequently asked questions
What does the DevSecOps podcast hub cover?
Building security guardrails into the pipeline instead of bolting them on — the software supply chain you didn't know you had, dependency and build-system attacks, leaked credentials, and the CVEs that turn a quiet Tuesday into an all-hands.
What practices does it focus on?
Scanning that surfaces real issues instead of noise, secrets management that survives contact with developers, and zero-trust and SBOM work that's more than a compliance checkbox.
Who is it for?
Engineers trying to make security a property of how they deploy rather than a gate sitting in front of it.
How are episodes selected?
They are auto-matched on DevSecOps topics — supply chain, vulnerabilities, SAST/DAST, secrets management, zero trust, SBOM, and CVEs — so the list reflects recent relevant episodes.
Is there a written security digest?
Yes — On Call Brief's DevOps Security News, linked from this page, covers actively-exploited CVEs and supply-chain advisories each week.