Skip to main content

Posts

JFrog CEO: No One Cares About Source Code Anymore

JFrog CEO Shlomi Ben Haim told approximately 500 software engineers today that in the age of artificial intelligence (AI) no one will soon care much about source code anymore. Speaking at the company’s swampUP 2026 conference, Ben Haim said AI tools are now creating executable binaries directly without relying on source code that historically existed to provide a method for humans to review code. However, in an era where AI tools are creating code that often isn’t even readable by a human application developer, the focal point for securing software supply chains is now moving to scanning application binaries, said Ben Haim. No one cares how many lines of source there are, he added. It’s not clear to what degree DevSecOps teams might be coming to a similar conclusion, but it’s apparent that the volume of code being created using AI coding tools is overwhelming existing DevSecOps workflows. An alternative approach to application security in the AI era would be to focus more on applyi...
Post a Comment
Read more
Recent posts

GitOps in 2026: Why Pull Requests Are Taking Over Cloud Operations

For years, cloud infrastructure changes were mostly a mystery. An engineer would log into a dashboard, tweak a setting, run a few scripts, and that was it. Nobody worried until something broke. Suddenly, everyone wanted answers. Who changed this? Was it tested? Can we fix it? How did production end up out of sync with what’s in the repo? Modern cloud setups make it impossible to ignore these questions. Teams wrangle Kubernetes clusters, cloud services, databases, networking, app configs, security policies, all spread across different environments. Manual changes just don’t scale. Enter GitOps. Instead of using Git solely for app code, teams now treat it as the source of truth for their infrastructure. You want changes? They go through pull requests, complete with reviews, automated checks, and approvals. Once Git gets updated, automated tools sync the real environment with what’s specified. By 2026, this process goes way beyond Kubernetes deployments. Pull requests are morphing int...
Post a Comment
Read more

CrowdStrike Moves to Secure Software Supply Chains at the Endpoint

CrowdStrike today at its Fal.con 2026 conference extended its reach into the realm of software supply chain security with the addition of an offering that blocks malicious open-source packages at the endpoint before their embedded code can run. Bartley Richardson, chief AI and autonomous systems officer for CrowdStrike, said Real-Time Supply Chain Attack Protection is designed to prevent both human developers and artificial intelligence (AI) coding agents from downloading malicious software packages that have been poisoned by malicious actors. The only place to effectively thwart these types of attacks is at the command line interface (CLI) running on the endpoint used to build an application, added Richardson. Based on a sensor that CrowdStrike relies on to secure endpoints, Real-Time Supply Chain Attack Protection intercepts open-source package manager transactions before any embedded script runs on a Windows, macOS or Linux endpoint. DevSecOps teams, as a result, have complete vi...
Post a Comment
Read more

JFrog Moves to Secure Agentic Engineering Workflows

JFrog today at its swampUP 2026 conference added a zero touch remediation capability that ensures the most secure version of a binary is provided even when application developers request a version that has known vulnerabilities. Additionally, JFrog is adding tools and capabilities to secure artificial intelligence (AI) agents that have been embedded within a DevOps workflow . For example, an AI Asset Scanning tool uses semantic scanning of markdown files, skills scripts, and instruction sets found in AI models, skills, plugins and Model Context Protocol (MCP) servers to block malicious behavior. There is also now an Agent Guard that extends the company’s core Artifactory registry to apply governance policies to plug-ins for AI coding agents. It natively enforces project-scoped allow/deny policies from AI Catalog within developer tools to ensure coding agents never bypass organizational guidelines and only consume approved AI assets. JFrog also revealed today it has added support f...
Post a Comment
Read more

GitHub Puts Copilot in the Approval Seat for Pull Requests

Code review has always had two parts: the feedback and the sign-off. GitHub Copilot has been able to handle the first part for a while now, leaving comments, catching bugs, and flagging style issues on pull requests. The second part — the actual approval that clears a PR to merge — has stayed a human job. That changed this week. GitHub announced that Copilot code review can now submit real approvals on pull requests, not just comments. When an organization turns the feature on, Copilot’s sign-off counts toward a repository’s required-approvals rule, just as a teammate’s approval would. It’s a small-sounding change with real weight: GitHub has moved Copilot from advisory to authoritative in the one place where code review actually gates what ships. Here’s how it works. Every Copilot code review already ends with an overview comment. That comment now includes an approval assessment, Copilot’s read on whether the pull request looks ready to merge. On i...
Post a Comment
Read more

Informing Stakeholders Isn’t the Same as Aligning Them

The first sign of trouble was a screenshot. We’d just switched on the A/B test via our feature management platform. Within the hour, a senior stakeholder landed in the variant feature flag, opened the app on their own phone, and sent us an image of it. The message, more or less: “Why is there a new tab in my app?” It was a fair question. It was also one I thought we’d answered weeks earlier. Turns out we never really had. That’s the day I learned the difference between telling people and aligning them. The Work We Were Proud Of My team was reworking the information architecture and frontend navigation architecture of our app. This wasn’t a cosmetic refresh. We were changing the top-level structure to match our product vision and make the app the home of our loyalty programme. It was a strategic bet, and it carried real commercial weight. We did the work properly, or so I believed at the time. We ran discovery sessions. We walked through the concep...
Post a Comment
Read more

Trusted Open Source Catalogs for AI and Developers

Open source supply chain security has been a scanner-and-CVE game for years — pull the package, run the scan, cross-reference known vulnerabilities, hope the metadata is current. That model always had gaps, and AI agents are widening them fast. Agents pull open source components from wherever they can find them, at machine speed, and the after-the-fact scan is not a control that keeps up. What developers and platform teams actually need is a curated catalog that vets components before they enter the environment, not after they cause a problem. Alan Shimel sits down with Leslie Pascual, Field Engineering Manager for AI and Security Solutions at ActiveState, to work through what a trusted open source catalog looks like in practice and why it becomes table stakes as soon as AI agents join the software supply chain. Pascual brings more than 20 years across engineering, architecture and leadership, with a stint hardening enterprise healthcare applications that pushed her into cybersecurit...
Post a Comment
Read more