Trace a Test Before You Trust Its Cache Hit
Inspect the work a test performs, then change a relevant input to check whether its cached result is invalidated.
TestifySecRead
← ResourcesIdeas you can
The TestifySec blog
Ideas you can
put to work.
Engineering lessons, product perspectives, and the work behind developer and agent trust.
54 articles
Introducing Pushgate: Evidence Before a Push Is Accepted
Give developers and agents the same requirements at the Git push boundary, with decisions you can inspect.
TestifySecRead
Know the Compliance Impact Before the Pull Request Merges
Review which configured compliance controls a pull request may affect, with an informational check in the developer workflow.
TestifySec EngineeringRead
The Signed Record We Didn’t Have in March
Why agent-written code needs inspectable execution evidence, protected signing authority, and a separate acceptance decision.
Cole KennedyRead
A Signed Build Is Not SLSA Level 3: Lessons from Our Hugo Experiment
What our original build experiment demonstrated, where its SLSA claim failed, and how to evaluate the signing boundary.
Cole KennedyRead
Check the Package Before You Publish It
Use a reviewed package inventory and an enforced verification step to catch unwanted release contents.
Cole KennedyRead
CI/CD Isolation: Keep Production Authority Away from Untrusted Code
Separate test execution from deployment authority, scope credentials, and verify the artifact you promote.
Cole KennedyRead
The LiteLLM Incident: Why Package Startup Behavior Matters
Separate package integrity, runtime observation, and incident response when assessing a compromised dependency.
Cole KennedyRead
The Trivy Compromise: What Pinning, Isolation, and Evidence Each Do
A review of the March 2026 incident and the distinct roles of prevention, observation, and policy verification.
Cole KennedyRead
Can You Trust the Evidence an Agent Gives You?
A signature cannot make fabricated evidence true. Start with the producer, the execution boundary, and the exact claim being verified.
Cole KennedyRead
Claude Code Hooks: Useful Feedback Before the Gate
Use local hooks for developer feedback, and keep authoritative repository decisions at a separately controlled boundary.
TestifySec EngineeringRead
Beyond “Trust Me, We Ran the Security Scan”: Evidence You Can Inspect
Tie a scan result to the source or artifact it examined, and make the producer and verification policy explicit.
Cole KennedyRead
Articles retain their publication dates. For current product behavior and setup instructions, use the documentation.
Ready to try a workflow?
Take the next step.
Find the right starting point for CI/lock, Pushgate, or the platform.