Blog
Notes on building a vulnerability platform
Design decisions, their reasoning, and the trade-offs we accepted. Mostly for people who will have to make the same calls.
engineering
The verdict belongs in the body, not the status code
Returning a policy failure as an HTTP error conflates two situations a pipeline must treat differently: the build being wrong, and the tool being unavailable.
product
Why a finding needs a memory
Every scanner produces a report. Almost none produce a record. That difference is why vulnerability backlogs get ignored, and what TRUSTIVAN is built around.