The first sign of trouble was a screenshot. We’d just switched on the A/B test via our feature management platform. Within the hour, a senior stakeholder landed in the variant feature flag, opened the app on their own phone, and sent us an image of it. The message, more or less: “Why is there a new tab in my app?” It was a fair question. It was also one I thought we’d answered weeks earlier. Turns out we never really had. That’s the day I learned the difference between telling people and aligning them. The Work We Were Proud Of My team was reworking the information architecture and frontend navigation architecture of our app. This wasn’t a cosmetic refresh. We were changing the top-level structure to match our product vision and make the app the home of our loyalty programme. It was a strategic bet, and it carried real commercial weight. We did the work properly, or so I believed at the time. We ran discovery sessions. We walked through the concep...
Open source supply chain security has been a scanner-and-CVE game for years — pull the package, run the scan, cross-reference known vulnerabilities, hope the metadata is current. That model always had gaps, and AI agents are widening them fast. Agents pull open source components from wherever they can find them, at machine speed, and the after-the-fact scan is not a control that keeps up. What developers and platform teams actually need is a curated catalog that vets components before they enter the environment, not after they cause a problem. Alan Shimel sits down with Leslie Pascual, Field Engineering Manager for AI and Security Solutions at ActiveState, to work through what a trusted open source catalog looks like in practice and why it becomes table stakes as soon as AI agents join the software supply chain. Pascual brings more than 20 years across engineering, architecture and leadership, with a stint hardening enterprise healthcare applications that pushed her into cybersecurit...