// writing & project notes
Blog & project notes.
DevOps and DevSecOps project write-ups, cloud security notes, supply-chain controls, and the messy bits of platform engineering. These posts connect the public GitHub projects to the decisions behind them.
-
22 Jun 2026
Project: Terraform Azure Landing Zone Lite
A public Terraform project plan for a secure Azure landing zone with policy, diagnostics, tagging, budget controls, and GitHub OIDC.
projectterraformazurepolicy-as-codeplatform-engineering -
21 Jun 2026
Project: Kubernetes Security Baseline
A Kubernetes security baseline for RBAC, network policies, admission controls, image scanning, and runtime detection thinking.
projectkubernetesopatrivycontainer-security -
20 Jun 2026
Project: SonarQube + Trivy DevSecOps Lab
A hands-on DevSecOps lab with Jenkins, SonarQube, Docker, Trivy, quality gates, and remediation notes.
projectjenkinssonarqubetrivyci-cd -
19 Jun 2026
Project: Cloud Cost Governance Bot
A Python automation project that turns cloud inventory exports into cost, tagging, ownership, and governance findings.
projectpythonfinopsgovernanceautomation -
18 Jun 2026
Project: Cloud Incident Response Runbooks
Public cloud incident runbooks for leaked secrets, exposed storage, suspicious IAM changes, and vulnerable container rollouts.
projectincident-responsecloud-securityrunbooksautomation -
2 May 2026
Managing dev secrets on macOS without losing your mind (or your tokens)
Every cloud engineer ends up with a wallet full of API tokens. Here's the pattern I use to make them always-accessible to my shell while keeping them out of dotfiles, repos, and backups.
macossecuritysecretsdeveloper-experience -
15 Apr 2026
A secure-by-default CI/CD pipeline template (and why bolting scanners on doesn't work)
Why DevSecOps fails when security is layered on top of an existing pipeline, and the shape of a template I've now rolled out three times — Checkov, Trivy, Gitleaks, Syft, OPA — that engineers actually adopt.
devsecopsci-cdcheckovtrivygitleakssbom