How Harness Helped Docaposte Secure Code and the Supply Chain
summary
Docaposte presents a concrete DevSecOps experience showing how to secure code and the software supply chain when developers and attackers both use LLMs. The talk explains a Human-first, “LLM-proof” approach that starts from real developer usage and implements four operational pillars—isolation, sanitation, supply-chain controls, and auditability—illustrated by a deployed architecture, explicit decisions and a real incident, with a practical checklist for architects, platform engineers and engineering managers.
AI-written summary · about
chapters (20)
- 0:00Securing CI/CD pipeline
- 1:03Code and dependency attacks
- 2:08Shift left with Harness
- 3:10Security scanners in pipeline
- 5:59Secure pipeline demo
- 8:48SBOM generation and posture
- 10:53360 dashboard for teams
- 12:00Governance policies
- 14:10Rego rules enforcement
- 16:41Protection from compromised tools
- 18:54Vulnerability monitoring
- 20:01Securing CI/CD for AI
- 21:06Harness on-premise integration
- 23:01Pipeline reproducibility
- 24:47Template migration and reuse
- 25:51Base image and library scans
- 26:54LLM usage policies
- 28:54Vulnerability remediation
- 30:26GitLab vs Harness
- 31:50Conclusion & Q&A
related talks
54mSecuring the Digital Supply Chain: What we should do for Supply Chain Security in DevSecOps?
42mThe Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain
46mHow to Harness Dev and Their Native Tools to Accelerate DevSecOps
48mDesigning a Secure Software Development Lifecycle with DevOps
49mBreaching LLM-Powered Applications: Overcoming Security and Privacy Challenges
59mSecuring the Digital Landscape: A Deep Dive into OWASP Top 10 for Applications, APIs, and LLMs
46mApplication security from start to finish
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast