Secrets Management in Defense CI/CD
How defense CI/CD pipelines handle secrets without embedding credentials in code — covering HashiCorp Vault, SOPS, Platform One's approach, and how to wire rotation events into your cATO evidence stream....
Technical Journal
Notes on secure systems, software delivery, and applied AI.
Field-informed writing on cybersecurity, DevSecOps, architecture, automation, and the engineering practices that make complex systems more trustworthy.
Start Here
Choose a path through the journal.
Recently Updated
Evergreen notes
Featured Essay
July 18, 2026
devsecops
Latest Notes
5 total
devsecops
The Defense DevSecOps Toolkit
A curated index of the policy documents, NIST publications, Platform One services, pipeline tools, and compliance resources that defense software teams actually use.
devsecops
Continuous ATO in Practice
A technical breakdown of Continuous ATO — what it actually requires, how OSCAL enables machine-readable evidence, and where most DoD programs fail to sustain it....
ai
ATO for AI Systems
How AI models actually get authorized in the DoD — the Assess Only construct, the coming NIST 800-53 AI overlays, and the re-authorization trigger problem...
cybersecurity
Army RMF 2.0: How the Updated Framework Works
How Army RMF 2.0 (Project Sentinel) restructured control selection, inheritance, and monitoring — and how it maps onto the DoD's new five-phase Cybersecurity Risk Management...