geminishkv — AppSec & DevSecOps Blog (EN)

AppSec Labs to pump yourself Release v.2.0.0

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 02 Apr 2026 00:00:00 GMT

🛠 AppSec Labs to pump yourself Release v.2.0.0 Salute, I’m back with an update on the labs, but this time it’s a really cool move forward and development for both of us. Look what a cool thing he added: • Preparing the working environment • Setting up Git, GPG and GitHub CLI • G

Meme beginning of April

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 01 Apr 2026 00:00:00 GMT

Meme beginning of April #lol

#lol

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 01 Apr 2026 00:00:00 GMT

#lol

Admin removed you from this channel

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 01 Apr 2026 00:00:00 GMT

Admin removed you from this channel Happy holiday, let's get stimulated 😅🤣

Dear God, I found a miracle that you need, you really need it too

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 31 Mar 2026 00:00:00 GMT

Dear God, I found a miracle that you need, you really need it too #lol

SecScore as an analogue of Quality Gate

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 31 Mar 2026 00:00:00 GMT

🛠 SecScore as an analogue of Quality Gate Let’s take a look today at a ready-made open-source solution that can be customized out of the box and can simply be reused in your own work (why not? as long as you follow the license 🤔). SecScore is an open-source tool for assessing b

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 31 Mar 2026 00:00:00 GMT

Fireworks, Current 🙃 #lol

offtopic, for estimation

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 30 Mar 2026 00:00:00 GMT

offtopic, for estimation #lol

Docker Level Security

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 30 Mar 2026 00:00:00 GMT

🛠 Docker Level Security Let's talk more about Docker and take a closer look at namespaces, cgroups, chroot, capabilities, seccomp. Understanding what's going on under the hood and how it works helps build a healthy safety model that allows assembly control and process separatio

Fireworks, I found a story here that shows the perception of information security by business, namely a human orchestra

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 30 Mar 2026 00:00:00 GMT

Fireworks, I found a story here that shows the perception of information security by business, namely a human orchestra 😅 #lol

Hacktrick for Application Security

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 27 Mar 2026 00:00:00 GMT

🛠 Hacktrick for Application Security Salute, Today I want to share with you a very voluminous material that will fly in (like children to school) for your upgrading and understanding of the deep principles of security - from the socket and TLS to namespaces, cgroups and kernel s

I’ve been playing around with IT competency certificates from the Ministry of Digital Development, I decided to try to pass their tests, which are so praised for hh, etc., in the end: cool, but nothing special, let it sit here

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 25 Mar 2026 00:00:00 GMT

I’ve been playing around with IT competency certificates from the Ministry of Digital Development, I decided to try to pass their tests, which are so praised for hh, etc., in the end: cool, but nothing special, let it sit here 🙃 I think I’ll do a couple more, for the masses, the

I.N.V.E.S.T. like a pill for the pain of misunderstanding

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 25 Mar 2026 00:00:00 GMT

🤔 I.N.V.E.S.T. like a pill for the pain of misunderstanding Today I want to touch on project management a little more, let’s talk to you about I.N.V.E.S.T. principle. I.N.V.E.S.T. used as a filter for tasks so as not to drag “everything in a row” into the current sprint. Essenti

geminishkv.tech

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 25 Mar 2026 00:00:00 GMT

🏆 geminishkv.tech Salute, UwU, I previously boasted about my geminishkv.tech and now I’ve finalized it, I’ll leave it in this form for now, but for you I brought out specially unified content links and a cool adaptive tool (I like the way the animation works). So, I added: • co

AppSec Labs to pump yourself up Release v.1.5.0

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 24 Mar 2026 00:00:00 GMT

🛠🏆 AppSec Labs to pump yourself up Release v.1.5.0 Fireworks, I posted the link here - course.geminishkv.tech An interesting update for you that I would like to tell you about the labs that I did earlier. Yes, exactly those labs that will show you the basic commands of the tool

Security SBOM generator with vulnerability chechup

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 23 Mar 2026 00:00:00 GMT

🛠Security SBOM generator with vulnerability chechup Salute, Today I want to share a tula that I twirled on the yoke. This tool helps you quickly and in a more convenient form collect SBOM for a project; this will be especially useful for certification according to FSTEC of Russi

When Local AI Becomes an Attack Vector: A Deep Dive into LLM Infrastructure Security

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 20 Mar 2026 00:00:00 GMT

When Local AI Becomes an Attack Vector: A Deep Dive into LLM Infrastructure Security Original text by Charles Senges The article “Deep dive into the deployment of an on-premise low-privileged LLM server” by Synacktiv examines how organizations deploy internal Large Language Model

Sometimes it seems that this is exactly what happens

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 20 Mar 2026 00:00:00 GMT

Sometimes it seems that this is exactly what happens 🙃 #lol

InfoSec Reco DBMS

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 20 Mar 2026 00:00:00 GMT

🤔 InfoSec Reco DBMS Salute, I think today it will be cool to look, together, at how best to approach the security of the database, the queue broker for writing to the database and, of course, partially the frontend part when interacting with the database. My recommendations are

geminishkv.tech

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 19 Mar 2026 00:00:00 GMT

🏆 geminishkv.tech UwU, in short, I made a website here for myself, I want to share with you, I think it turned out especially cool with the glitch, the adaption was delivered separately. geminishkv.tech - check it out, but of course it’s simple, but effective for the portfolio �

Tests by FSTEC of Russia GOST 71207

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 19 Mar 2026 00:00:00 GMT

🏆 Tests by FSTEC of Russia GOST 71207 I previously wrote about these tests here, that my guys and I at LANIT received a certificate for our company for the contribution we made, and now a very pleasant story has arrived, another one. I love it when it motivates like that, don’t

DevSecOps Toolchain Map

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 19 Mar 2026 00:00:00 GMT

🛠 DevSecOps Toolchain Map Salute, Good news, I once talked about the tool map here. Finally, it was uploaded in release 2.0.1 to the repository of our community findevsecops.ru, check it. Now there will be a boost to the tool map itself and you can participate with us in the dev

Information security at all stages of the software development life cycle

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 18 Mar 2026 00:00:00 GMT

🏆 Information security at all stages of the software development life cycle Fireworks, let me remind you that the MIPT course is starting very soon, I’ll share the schedule here. In the meantime, you can swing on the labs, which will soon receive a new release and will also be t

Yandex picked good numbers

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 17 Mar 2026 00:00:00 GMT

Yandex picked good numbers 😅🙃 #lol

WSO2 InfoSec Reco

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 17 Mar 2026 00:00:00 GMT

🤔 WSO2 InfoSec Reco Salut, let's catch up with you, to yesterday's post, let's look at the information security requirements that will help us with integrations. These requirements will reduce the risks associated with cybercrimes, leaks, and non-compliance. We are taking a clos

WSO2 MI/ APIM from an AppSec point of view

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 16 Mar 2026 00:00:00 GMT

🛠 WSO2 MI/ APIM from an AppSec point of view Salute, It was a bit stuffy last week, I hope I’m the only one who experienced this, and the memes were useful for you, sometimes you need to melt your brain 🙃 Often in practice and when researching integration cases, I look towards

Sorry, but it’s somehow vital

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 11 Mar 2026 00:00:00 GMT

Sorry, but it’s somehow vital #lol

MIPT course on DevSecOps

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 11 Mar 2026 00:00:00 GMT

🏆 MIPT course on DevSecOps Fireworks, Today I want to share the pleasure from my own cool kids, at the MIPT course, I’m very glad when they stimulate me like that #course #paper

Salute,

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 10 Mar 2026 00:00:00 GMT

Salute, No, well, it’s secure - pamagite #lol

Salute,

shmakovis@inbox.ru (Ilya Shmakov) — Sun, 08 Mar 2026 00:00:00 GMT

Salute, Dear, happy holiday, so that you can also be beautiful and feel more amazing every day, get what you deserve and deserve, happy day 🫶🙏

FRIDA must for Mobile AST

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 06 Mar 2026 00:00:00 GMT

🛠 FRIDA must for Mobile AST Salute, Today we’ll look at Tula, which becomes extremely useful for testing mobile clients from the first steps. I recommend that you immediately look in her direction, because it will help you correctly develop an understanding of the security analy

Colleagues, I remind you that soon there will be a new stream at MIPT in the information security course, get involved, I will be glad to see you

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 06 Mar 2026 00:00:00 GMT

Colleagues, I remind you that soon there will be a new stream at MIPT in the information security course, get involved, I will be glad to see you 🙃 #course #appsec #devsecops #specialty

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 06 Mar 2026 00:00:00 GMT

Fireworks, It’s not March 1st anymore, no, well, in our realities, but in my opinion it will devour us #lol

Hydra for target targeting

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 04 Mar 2026 00:00:00 GMT

🛠 Hydra for target targeting Salute, Today we’ll look at a tool that will always be at hand and you can use it to test services for security credentials for web applications, APIs and infrastructure, both in a simple format and in a more narrowly focused manner (dogs: but you ca

Okay, I like it

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 03 Mar 2026 00:00:00 GMT

Okay, I like it And tomorrow will be interesting #lol

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 03 Mar 2026 00:00:00 GMT

Fireworks, Right on point, especially when I was waiting for it #lol

As if everything had already crept up, unnoticed, the end of an era ‍↕️

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 02 Mar 2026 00:00:00 GMT

As if everything had already crept up, unnoticed, the end of an era 🫡🙂‍↕️ #lol

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 02 Mar 2026 00:00:00 GMT

Fireworks, Let me remind you about the award I talked about here. Read the news from your colleagues from the AFL and I will be glad to see your work for review 🙏 #appsec #devsecops #specialty #toolchain #vulnmanagement #toolchain #compliance #gost #techsolution #pmicases

We are moving LANIT at the pleasant invitation from colleagues from RBPO.rf

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 27 Feb 2026 00:00:00 GMT

We are moving LANIT at the pleasant invitation from colleagues from RBPO.rf Beautiful 🙃 #appsec #devsecops #paper

Sometimes in the heart

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 27 Feb 2026 00:00:00 GMT

Sometimes in the heart #lol

Oh my god, holy cats, we need this

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 27 Feb 2026 00:00:00 GMT

Oh my god, holy cats, we need this 😅🤣 #lol

GeoIP‑lookup Checker

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 26 Feb 2026 00:00:00 GMT

🛠 GeoIP‑lookup Checker Salute, I want to share. with you a small utility that allows you to quickly view the geolocation of IP addresses and domains, as well as enrich HTTP traffic in Burp Suite by integrating it as a plugin. I decided to start writing this tool to simplify inte

Salut, while I was preparing a mini chip for my hands, I came across something that I have to share

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 25 Feb 2026 00:00:00 GMT

Salut, while I was preparing a mini chip for my hands, I came across something that I have to share #lol

Deepteam Confident AI as Red Team

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 24 Feb 2026 00:00:00 GMT

🛠Deepteam Confident AI as Red Team Let’s look at this tula again, it’s very interesting and I saw it purely by chance in Svetlana Gazizova’s group, I want to share with you my opinion about it. Deepteam is an open-source CLI from Confident AI for running autotests and “guardrail

Review of OWASP Top 10 2025 for Java

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 24 Feb 2026 00:00:00 GMT

🛠 Review of OWASP Top 10 2025 for Java Salute, You and I recently started looking towards OWASP TOP 10 (here) for Semgrep rules. I think it would be cool to do a review on OWASP with specifics for Java, where I can further show why it’s cool in a custom way for this language. Mo

Dear, happy holiday, may you also stand until the end

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 23 Feb 2026 00:00:00 GMT

Dear, happy holiday, may you also stand until the end 🙏🫶

Fireworks, everyday things (look at DMB)

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 20 Feb 2026 00:00:00 GMT

Fireworks, everyday things 🫡 (look at DMB) #lol

We are actively expanding our stock of sayings

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 19 Feb 2026 00:00:00 GMT

We are actively expanding our stock of sayings #lol

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 19 Feb 2026 00:00:00 GMT

Fireworks, I’ll put it here and leave it like this for now, don’t forget (well, I really should have, remember): Risk is a factor that reflects the possible damage to an organization as a result of an information security threat: information leakage and its misuse (the risk ulti

And right there in the furnace

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 18 Feb 2026 00:00:00 GMT

And right there in the furnace 🙃

Leadership in FinDevSecOps

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 18 Feb 2026 00:00:00 GMT

🏆 Leadership in FinDevSecOps Salute, Today I want to talk to you about what I consider important to me and why I am interested in all this. To be honest, we all think about our contribution, in some way, well, at least we are talking about who is interested in it. Therefore, we

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 17 Feb 2026 00:00:00 GMT

Fireworks, Remembering old school clips and in the current time this is relevant #lol

Well, in general, on the topic of patch day

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 16 Feb 2026 00:00:00 GMT

Well, in general, on the topic of patch day #lol

And yes, on the topic for business, about ROI:

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 16 Feb 2026 00:00:00 GMT

And yes, on the topic for business, about ROI: • Reducing the cost of fixing vulnerabilities by 40-70% • Reduced time-to-market information security checks, that is, fewer blockers before release • Improved security posture, that is, fewer incidents • Compliance, that is, it is e

Secure SDLC DevSecOps framework

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 16 Feb 2026 00:00:00 GMT

🤔 Secure SDLC DevSecOps framework Salute, I think today we will look at the concept of technical implementation of DevSecOps. Thus, we will collect the picture from previous posts and go further into the interesting things 🙃 SSDLC - Secure Software Development Lifecycle: a deve

Salute,

shmakovis@inbox.ru (Ilya Shmakov) — Sat, 14 Feb 2026 00:00:00 GMT

Salute, Dear, happy holiday to you, I hope everything is great with your other half, if you are looking, then this day will allow you to enjoy everything too 🙏🙃

Holy cats, life, only “understand and forgive”

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 13 Feb 2026 00:00:00 GMT

Holy cats, life, only “understand and forgive” And interesting things are waiting for you from Mon 😉 #lol

Ultanul

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 13 Feb 2026 00:00:00 GMT

Ultanul

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 13 Feb 2026 00:00:00 GMT

Fireworks, Interesting interaction and marketing from hh, but the guy really opened a Pandora's box in our hearts (well, no one would love that). #lol

GoSec Checker

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 12 Feb 2026 00:00:00 GMT

🛠 GoSec Checker Salut, let's continue and look at the analyzer that you definitely need if you write or test in golang. The tool scans AST and SSA to detect vulnerabilities that grep-based scanners miss. Finds unsafe queries to the database, Path Traversal, hardcoded secrets, to

Semgrep Rules OWASP A08:2024 – Software and Data Integrity Failures

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 11 Feb 2026 00:00:00 GMT

🛠 Semgrep Rules OWASP A08:2024 – Software and Data Integrity Failures Salute, Today I want to share with you the rules for semgrep on software and data integrity violations - OWASP A08:2024. This is a category that includes “Insecure Deserialization,” where the application does

ShellCheck as small helper

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 10 Feb 2026 00:00:00 GMT

🛠 ShellCheck as small helper Salute, Today I want to look at the ShellCheck tool with you. This is a static analyzer of shell scripts such as sh, bash, dash, ksh, which looks for unsafe constructs and non-portable code. This is a CLI utility (GPLv3) that parses scripts, builds A

Looking at apartment prices

shmakovis@inbox.ru (Ilya Shmakov) — Sat, 07 Feb 2026 00:00:00 GMT

Looking at apartment prices 😟 #lol

Well, okay, just try the reverse

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 06 Feb 2026 00:00:00 GMT

Well, okay, just try the reverse

I guess I'll leave this here

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 06 Feb 2026 00:00:00 GMT

I guess I'll leave this here #lol

Review of PrintNightmare CVE‑2021‑34527

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 06 Feb 2026 00:00:00 GMT

🥶 Review of PrintNightmare CVE‑2021‑34527 Salute, Today we’ll look at PrintNightmare, which I wrote about in the last post - this is a classic example of how a service on Windows turns into an entry point for RCE and a platform for the deliberate atrocities of Vice Society and M

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 05 Feb 2026 00:00:00 GMT

Fireworks, IBshnoe black 🙃 #lol

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 04 Feb 2026 00:00:00 GMT

Fireworks, On the topic of “split” for the shop and Delivery 😅🤣 #lol

Review of Metro4Shell CVE‑2025‑11953

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 03 Feb 2026 00:00:00 GMT

🥶 Review of Metro4Shell CVE‑2025‑11953 Salute, An interesting vulnerability in the React Native Community CLI (Metro dev server) has begun to appear everywhere, which can help you understand RCE-type attacks in more detail. RCE (Remote Code Execution) is a remote code execution

New growth point for the channel

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 03 Feb 2026 00:00:00 GMT

🙃 New growth point for the channel Salute, I am very pleased to note that you and I have set a new growth bar, namely, we are already more than 300. Thank you for supporting me and motivating me, I hope the materials are useful for you and you can download them 🙏 The best, hug

New meanings to the painfully old and familiar

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 02 Feb 2026 00:00:00 GMT

New meanings to the painfully old and familiar #lol

Sometimes it's so "exciting"

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 02 Feb 2026 00:00:00 GMT

Sometimes it's so "exciting" #lol

Good,

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 02 Feb 2026 00:00:00 GMT

Good, And here is exactly what you need 😅 #lol

Fireworks, a reminder for the important and very busy, take care of yourself

shmakovis@inbox.ru (Ilya Shmakov) — Sun, 01 Feb 2026 00:00:00 GMT

Fireworks, a reminder for the important and very busy, take care of yourself 🫶🙏🙃 #lol

MSTU team. Bauman was awarded the Order "For Valiant Labor"

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 29 Jan 2026 00:00:00 GMT

🏆 MSTU team. Bauman was awarded the Order "For Valiant Labor" Salute, as a participant in this event, I will be very happy to share this news with you. Russian President Vladimir Putin awarded MSTU. N.E. Bauman with the Order “For Valiant Labor”, namely for a major contribution

Attack vectors of the TRACE method

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 28 Jan 2026 00:00:00 GMT

🛠 Attack vectors of the TRACE method Salute, I often ask the guys I meet who know how to use DAST and have at least touched the API in some way, about the TRACE method and I see that they barely touch on it. I think it’s worth sharing with you a description of the problems. Let

k8s Secure Network Policy

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 27 Jan 2026 00:00:00 GMT

🛠 k8s Secure Network Policy Salute, I decided to share a useful resource about network security policies as a continuation of the previous topic. You can check the editor here. networkpolicy.io is an interactive web editor for Kubernetes, including policies for Cilium. The resou

Cilium CNI Secure Profile

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 26 Jan 2026 00:00:00 GMT

🛠 Cilium CNI Secure Profile Salute, I previously described here what CNI is, and I also talked about Cilium with examples, and today I want to share with you the full profile for it. This profile contains a couple of policies for cluster baseline and butt. Let's take a closer lo

Vulnerable MCP Servers Lab

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 23 Jan 2026 00:00:00 GMT

🛠Vulnerable MCP Servers Lab A little stolen, but worth sharing, I think you'll like it. Follow the link with 9 labs from AppSecco dedicated to the insecure implementation of MCP. #toolchain #appsec #course

Semgrep Rules OWASP A03:2024 – Injection (SQL/OS/Expression)

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 23 Jan 2026 00:00:00 GMT

🛠 Semgrep Rules OWASP A03:2024 – Injection (SQL/OS/Expression) Salute, Today I want to share with you the rules for semgrep for injections according to OWASP A03:2024. I think that I will periodically give examples so that they can be refined and reused. Injections are a class

A little meme, vital for all of us under 22% VAT.

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 22 Jan 2026 00:00:00 GMT

A little meme, vital for all of us under 22% VAT. #lol

Search for vulnerabilities in software during exploitation

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 22 Jan 2026 00:00:00 GMT

🤔 Search for vulnerabilities in software during exploitation Today I listened to a cool webinar with Artem Khramykh from AktivConsulting. I hope the recording will be available to you soon and you will be able to note the main features, but for my part I will note the following:

Checkov SAST profile

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 21 Jan 2026 00:00:00 GMT

🛠 Checkov SAST profile I started rebuilding custom profiles, and I wanted to share with you an example for checkov that we reviewed. The example profile is for Docker and Helm infrastructure. Goal: minimize the attack surface of containers, eliminate storing secrets in images an

DevSecOps Award for the Russian FinTech market

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 21 Jan 2026 00:00:00 GMT

🏆 DevSecOps Award for the Russian FinTech market Salute, Today I want to start with you with an official review of the award, which I previously presented to you first-hand here. My colleagues and I created the “Security Starts with Code” award, read the review from the AFL her

Checkov SAST for IAC

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 19 Jan 2026 00:00:00 GMT

🛠 Checkov SAST for IAC Salute, Let's continue to look further towards instruments and today we will talk about Anton Pavel.. Checkov (doc): It is an Infrastructure as Code (IaC) static analysis tool (SAST) that scans configurations for security and standards compliance errors b

Channel photo updated

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 19 Jan 2026 00:00:00 GMT

Channel photo updated

Non-trivial Reco for networking and repository management

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 16 Jan 2026 00:00:00 GMT

🛠 Non-trivial Reco for networking and repository management Today I want to continue the previous topic and share with you materials on segmentation and repository management. We will look at the control of repositories at the access level later together, and yes, we will look a

Fireworks, I can’t resist, so pay attention to your profile hello to those involved

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 16 Jan 2026 00:00:00 GMT

Fireworks, I can’t resist, so pay attention to your profile 😅🤣 hello to those involved #lol

Non-trivial Reco in software development

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 14 Jan 2026 00:00:00 GMT

🛠 Non-trivial Reco in software development Salute, Today I want to share with you the specific information security requirements for development and some of them will be examples. You and I will look at what you cannot always see or take into account. I think this will be useful

Benchmark InfoSec Risks

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 13 Jan 2026 00:00:00 GMT

🤔 Benchmark InfoSec Risks Salut, you and I once looked at a case on information security risks here, and now I think it’s time to deal with the benchmark information security risks. I will give a typical description and classification, that is, it is universal and can be adapted

Netflix Security Monkey as Chaos Engineering

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 12 Jan 2026 00:00:00 GMT

🛠 Netflix Security Monkey as Chaos Engineering Salute, The holiday festivities are over, now it’s time for the waste disposal facilities to get back to work. But for you, I’ll keep the New Year’s logo for now to make it warmer. And we’ll start the year with Chaos Monkey, remembe

Dear, happy new year, thank you for being there and supporting me, I am incredibly grateful and glad to see you happy new year, happy new happiness and may you have everything that you deserve and what you want to achieve!

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 31 Dec 2025 00:00:00 GMT

Dear, happy new year, thank you for being there and supporting me, I am incredibly grateful and glad to see you 🫶 happy new year, happy new happiness and may you have everything that you deserve and what you want to achieve! You are the best 🙃🫡 Happy holiday, kayfani 🙏

Fireworks, dear,

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 31 Dec 2025 00:00:00 GMT

Fireworks, dear, Meanwhile, New Year is coming very soon 🎄🫶🙏 Smile 😅🙃

DevSecOps Toolchain Release 2.0.0 Map

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 29 Dec 2025 00:00:00 GMT

🛠 DevSecOps Toolchain Release 2.0.0 Map Fireworks, Now I will share a major release with you again, I previously told you about it here. DevSecOps Toolchain Map is an interactive map of tools for DevSecOps and AppSec tools that helps architects, security specialists and develope

Salute, meanwhile, I will soon release a cool release on the AppSec tool map, but for now there are 5 days until the new year.

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 26 Dec 2025 00:00:00 GMT

Salute, meanwhile, I will soon release a cool release on the AppSec tool map, but for now there are 5 days until the new year. Praying for the “holy cow” 🤣 #lol #backstage

9 days until the new year.

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 22 Dec 2025 00:00:00 GMT

9 days until the new year. Without a doubt 🤣 #lol #backstage

AppSec Labs to pump yourself up Release v.1.4.0

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 22 Dec 2025 00:00:00 GMT

🛠🏆 AppSec Labs to pump yourself up Release v.1.4.0 Fireworks, There’s an interesting update for you that I’d like to tell you about. I recently decided to download another external device for Labok and update the data on it. Here you and I looked at the first release and I will

There are 13 days until the new year.

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 18 Dec 2025 00:00:00 GMT

There are 13 days until the new year. Vital for all of us 🫡 #lol #backstage

DevSecOps Toolchain Map

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 18 Dec 2025 00:00:00 GMT

🛠 DevSecOps Toolchain Map Salute, Interesting news, I’m here in continuation of this topic, now I’m finishing up the map of tools, I’m uploading a pre-roll for you so that you can take a closer look at the update in the draft, I plan to upload information for you early next week

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 15 Dec 2025 00:00:00 GMT

Fireworks, There are 16 days until the new year. Therefore it is relevant 🫡🙃 #lol #backstage

Results of the year 2025 of the FinDevSecOps community

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 12 Dec 2025 00:00:00 GMT

🤔 Results of the year 2025 of the FinDevSecOps community Salute, Tough week, huh? Come on, at the end of all this, I will share with you the results that we discussed at our findevsecops.ru community conference. I described a small pre-roll here. As a result, we were able to ach

AppSec Labs to pump yourself up Release v.1.3.0

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 10 Dec 2025 00:00:00 GMT

🛠🏆 AppSec Labs to pump yourself up Release v.1.3.0 Fireworks, I have put together some cool AppSec labs for you, including: Risk Analysis, GitSCM, Docker and Compose training, several SAST, SCA, DAST, Secret Detection and a demo stand to get your hands on exploited vulnerabilit

Tests of FSTEC of Russia GOST 71207 for SAST analyzers

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 09 Dec 2025 00:00:00 GMT

🏆 Tests of FSTEC of Russia GOST 71207 for SAST analyzers Fireworks, First hand, My kids and I took part in tests according to GOST 71207 for SAST. As a result, Irina Gefner (FSTEC) and Dmitry Ponomarev (ISPRAN / Phobos) awarded us with such a cool report at the ISP RAS open co

Script for Docker CIS & Image Audit

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 08 Dec 2025 00:00:00 GMT

🛠 Script for Docker CIS & Image Audit Salute, Let's start the week with practice, I decided to share the custom, since you can use it for triage and report conversion. Scenario - Determines the Linux/macOS/other platform and selects the image as the main one for auditing - Cre

Well, you understand

shmakovis@inbox.ru (Ilya Shmakov) — Sat, 06 Dec 2025 00:00:00 GMT

Well, you understand 🤣🤣🤣 #lol #backstage

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Sat, 06 Dec 2025 00:00:00 GMT

Fireworks, Happy Saturday 🙃 #lol #backstage

Cheatsheet will rock you: Docker

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 05 Dec 2025 00:00:00 GMT

🛠 Cheatsheet will rock you: Docker Let's take a breath and just bookmark it. Today, lastly, I want to share with you a cheatsheet on Docker and what problems/solutions there may be. General description docker exec -it # execute command

Annual FinDevSecOps community meetup

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 05 Dec 2025 00:00:00 GMT

🏆 Annual FinDevSecOps community meetup I want to share with you the news that we are hosting another meetup of our community findevsecops.ru. The FinTech Association @fintechassociation is holding a meetup: December 08, 2025 from 11.00 to 17.00. Venue: T1 office at Moscow, Lenin

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 05 Dec 2025 00:00:00 GMT

Fireworks, Friday 😅🫶 #lol #backstage

Cilium as Container Network Interface k8s

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 04 Dec 2025 00:00:00 GMT

🛠 Cilium as Container Network Interface k8s Salute, Today I want to share with you a description regarding CNI controls under Kubernetes. We'll take a look at the Cilium CNI plugin. But we will look at it more from the technical side. Serves to provide network connectivity, secu

DevSecOps Toolchain MAP Release v.1.1.2

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 03 Dec 2025 00:00:00 GMT

🛠🏆 DevSecOps Toolchain MAP Release v.1.1.2 Fireworks, I’ve made a map of tools for AppSec and its classes. Yes, it’s the same one that I wrote about earlier in this post and I really want to share it with you. Look, you can check it and use filtering. Here is the source of the

Fireworks,

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 28 Nov 2025 00:00:00 GMT

Fireworks, A reminder that Signal will soon be in the hall to discuss a cool topic that he highlighted here. I'm waiting for you online and offline 🙏 #devsecops #roadmap #meetup #conf #compliance #gost #backstage

Discussion “Career tracks for secure development: from IT to security and back”

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 27 Nov 2025 00:00:00 GMT

🚀 Discussion “Career tracks for secure development: from IT to security and back” Salute, Tomorrow there will be an event to which T1 was invited, namely IMPULSE, you can tune in and listen to what the guys and I will talk about. Among the participants: - Moderator: Dudnik Stepa

Cheatsheet will rock you: GitSCM

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 26 Nov 2025 00:00:00 GMT

🛠 Cheatsheet will rock you: GitSCM Salute, Today I want to share with you some cheatsheet on gitscm, it will help you understand the topic and start committing, resolving conflicts with version history when developing software. Base $ git init # Initialize an empty local reposit

DevSecOps Award for the Russian FinTech market

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 25 Nov 2025 00:00:00 GMT

🏆 DevSecOps Award for the Russian FinTech market Salute, Today I want to share with you a cool topic, first-hand, just shhh. My colleagues and I began to create a fintech award for the Russian market: “Security begins with code.” Security in software development is critical to

Salute,

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 24 Nov 2025 00:00:00 GMT

Salute, Hard day, but I think it will get better tomorrow 😅 In the meantime, I’ll share with you a ball from LANIT at the MIPT rate, which starts this Thursday. Info here. #devsecops #pmi #course #toolchain #riskanalys #pmcases #techsolutions #compliance

Little’s Law in Queuing Theory for control in mathematical representation

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 21 Nov 2025 00:00:00 GMT

🤔 Little’s Law in Queuing Theory for control in mathematical representation Salute, I just remembered that in the end the matan tower comes in handy, no matter what anyone says 😅 And in general, if you use it correctly, you can very effectively calculate the risks of the influe

Experience of primary court cases that shaped the practice of using electronic signatures

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 20 Nov 2025 00:00:00 GMT

🤔 Experience of primary court cases that shaped the practice of using electronic signatures Salute, Today I’m a little late and that’s why I’m writing to you only now. It occurred to me to tell you a historical background about the Federal Law “On Electronic Signatures” dated 04

Product Requirement Document for Shift-Left

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 19 Nov 2025 00:00:00 GMT

🤔 Product Requirement Document for Shift-Left Salute, Today I want to share with you my practice for project management (PMI), which allows me to see the conceptual picture and analyze the correctness of the DevSecOps processes, AppSec Toolchain integration and human resource ma

Atypical DevSecOps practices for CI/CD

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 18 Nov 2025 00:00:00 GMT

🛠 Atypical DevSecOps practices for CI/CD Salute, Let’s continue to look towards DevSecOps practices and this time we’ll discuss CI/CD, where I want to share with you the developed principles that I consider relevant and basic when developing concepts. Continuous Integration/Cont

Nuclei: open-source DAST using YAML templates

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 17 Nov 2025 00:00:00 GMT

🛠 Nuclei: open-source DAST using YAML templates Salute, Let's take a look today at dynamic testing DAST, which uses the YAML templating engine. I want to share with you a handy tool that is commonly used in addition to Burp Suite. Description Supports web applications, APIs, net

Course for MIPT on secure development

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 14 Nov 2025 00:00:00 GMT

🛠 Course for MIPT on secure development At the end of this day, I want to tell you about the information that appeared in the media with interesting comments. Previously, I wrote about MIPT and the course I did for them here. In the course, I explain practical value to students

Open Source Strong & Weak Copyleft Licenses

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 14 Nov 2025 00:00:00 GMT

🤔 Open Source Strong & Weak Copyleft Licenses Salute, You and I previously looked at what free and proprietary software is here, and also looked at permissive licenses here. Now I suggest you look at open-source types like Unlicense and Strong, Weak Copyleft Licenses. These typ

Hello everyone,

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 13 Nov 2025 00:00:00 GMT

Hello everyone, Today it will be cool to look at such a case at the teleconference, its comparison with zoom and the topic of secure confcalls - well, if you want to 😅😄 I liked the comment from the security director 😕 #backstage #lol

DevSecOps practices for C

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 11 Nov 2025 00:00:00 GMT

🛠 DevSecOps practices for C Salute, Let's look at OOP today, from the perspective of non-standard recommendations for C. I think this is a useful start, especially when you are just looking towards development, and in this way you can understand for yourself where it is better t

DevSecOps practices for Android

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 07 Nov 2025 00:00:00 GMT

🛠 DevSecOps practices for Android Salute, Firstly, you and I have a great growth statistic, namely, we already have 200 subscribers. I'm very happy about this. Thank you for monitoring the materials in the channel 🙏 Secondly, today I want to share practical experience with the

Access Control Terminology

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 06 Nov 2025 00:00:00 GMT

🤔 Access Control Terminology Salut, let's finish the day by looking at access rights and separately highlight take-grant as a cool mechanism, it will help you understand nix and understand how the role model works. And I’m smoothly rolling back and preparing cool content for you

Security Champion Terminology

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 05 Nov 2025 00:00:00 GMT

🤔Security Champion Terminology Salute, There are a lot of questions about the market, who are these people and what do they do? I tell you the details here, and this post is for you, so that you can clearly see the difference and note what is important for yourself. #term #pmcas

Terminology Malicious

shmakovis@inbox.ru (Ilya Shmakov) — Sat, 01 Nov 2025 00:00:00 GMT

🤔 Terminology Malicious Fireworks, the difficult 6th day of the week, so we will look at what malware is and what types of their implementation there are. #term #pmcases

CyberDefend Terminology

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 30 Oct 2025 00:00:00 GMT

🤔 CyberDefend Terminology Salute, let's start looking at the base and how business operates within the framework of information security risks. #term #pmcases #riskanalys

Grype as SCA for artifacts

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 30 Oct 2025 00:00:00 GMT

🛠 Grype as SCA for artifacts Salute, today I propose to look at another open source tool for scanning vulnerabilities in container images and file systems. Grype works at the artifact level, not the source code level, and scans software packages. Supports Python, JavaScript (NP

MITM Terminology

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 29 Oct 2025 00:00:00 GMT

🤔 MITM Terminology Salute, I thought it would be cool to see posts with terminology that will allow you to broaden your horizons and be more conscious about your wording. We will take an atypical base, as usual, but we will still touch on something classic. Next we will conside

Non-trivial security base for Docker

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 28 Oct 2025 00:00:00 GMT

🤔 Non-trivial security base for Docker Wow, you've got it, let's do it, I often come across questions about the security of containers, mostly about the subtleties of their settings. Non-trivial things are not always visible, such as the host network type being set under the hoo

Typical "sins" of using JWT

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 28 Oct 2025 00:00:00 GMT

Typical "sins" of using JWT Salute, I recently crossed paths with colleagues with whom I recorded a podcast on secure development - info here. It so happens that I would like to share with you an interesting approach, somewhat reminiscent of the classic model. These guys involv

Bandit as linter on pre-commit

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 27 Oct 2025 00:00:00 GMT

🛠 Bandit as linter on pre-commit Salute, Let's take a look at SAST for python today. We look at Bandit as a linter, because it is convenient to use it without analyzing and delving into business logic, because the tool does not know how to do this. It’s also useful for integrati

Open Source Permissive Licenses

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 24 Oct 2025 00:00:00 GMT

🤔 Open Source Permissive Licenses Salute, you and I once looked at what free and proprietary software is here, and I think it’s time to look in more detail at the types of permissive licenses. In the attachment I have provided a description that will help you learn to distinguis

Autoswagger: easy accessibility check without authorization

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 23 Oct 2025 00:00:00 GMT

🛠 Autoswagger: easy accessibility check without authorization Salute, I came across the general description of Autoswagger by intruder.io a couple of times. I decided to look at a quick and lightweight tool. The tool allows you to run along the protruding API handles on the out

DevSecOps and CI/CD certification according to GOST 56939

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 22 Oct 2025 00:00:00 GMT

🥶 DevSecOps and CI/CD certification according to GOST 56939 Fireworks, I haven’t been out here for long yet, I’ll be back soon with a high-quality update for the channel, it’ll be a blast. For now, I would like to share one of the pain points that was discussed in the community

Kaizen Event: +10/10 efficiency

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 14 Oct 2025 00:00:00 GMT

🤔 Kaizen Event: +10/10 efficiency Salute, Earlier we looked at what DMAIC is. Now we should consider the special tool used to achieve this goal. I will say that this is a cool tool that can be used in practice, and it also has subtlety, it can be used for artificial conflicts. Y

AppSec & DevSecOps

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 14 Oct 2025 00:00:00 GMT

🤣 #lol

Course for MIPT on secure development

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 13 Oct 2025 00:00:00 GMT

🛠 Course for MIPT on secure development Salute, Начнем неделю с прикольного, я тут активно работаю над новой программой обучения (ну как, уже релижу) для Московского Физико-Технического Института МФТИ и думаю, что прикольно поделиться с тобой этим. Here you can read the pre-roll

WHOA! Channel Value Provided

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 10 Oct 2025 00:00:00 GMT

🤔 WHOA! Channel Value Provided Salute, I thought about it and looked at the activity in the channel over these couple of weeks. Here is a post about me and what I consider special, in some way, in my practice. I created this channel in order to share the current practice of AppS

When you collect everything around you from scratch

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 10 Oct 2025 00:00:00 GMT

When you collect everything around you from scratch #lol #backstage

DMAIC: as a value system for optimization

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 09 Oct 2025 00:00:00 GMT

🥶 DMAIC: as a value system for optimization You and I can talk not only about information security, but also about how to survive with developers and at the same time understand the “kitchen cooking”. Against this backdrop, we can use these methods to our advantage and develop w

Sounds great, in our realities, for a startup

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 09 Oct 2025 00:00:00 GMT

Sounds great, in our realities, for a startup #lol

.dockerignore: ignored when building image

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 09 Oct 2025 00:00:00 GMT

🛠 .dockerignore: ignored when building image Salute, We looked at the principle of ignoring for .gitignore here, and now we’ll look at the principle for .dockerignore. That is, we will look at what allows you to ignore docker when building an image. Ignoring is similar to .gitig

DevSecOps & AppSec Toolchain database

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 08 Oct 2025 00:00:00 GMT

🛠 DevSecOps & AppSec Toolchain database So, we're here for secure development and AppSec tools. Let's look at the process as a whole and the tools themselves, I think it's time to start uploading materials that will help you delve into the very stages of development in terms of

"administrator's fun"

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 08 Oct 2025 00:00:00 GMT

"administrator's fun" #lol #backstage

Licensing: free and proprietary

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 08 Oct 2025 00:00:00 GMT

🤔 Licensing: free and proprietary We looked at what copyright is (subjects, objects, etc.). In the post I made a footnote about the MIT license, let's see what types of licenses there are and why it is important for us to understand them, in order to make our own custom products

Interview with the BISA association on information security risks and secure development

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 08 Oct 2025 00:00:00 GMT

🎧 Interview with the BISA association on information security risks and secure development Salute, I found a bearded in the bins, but still relevant interview with the BISA association @bisafm - about secure software development, information security risks and how to be friends

Results of GuardConf 2025

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 07 Oct 2025 00:00:00 GMT

😅Results of GuardConf 2025 As a result, the conference was done, I digested my impressions earlier, but decided to share my thoughts only now. Let me remind you that I described the main thing that will happen here. I described my impressions during the conference here. The cont

SBOM: lightweight cdxgen generation

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 07 Oct 2025 00:00:00 GMT

🛠 SBOM: lightweight cdxgen generation Earlier, we looked here at what the Software Bill of Materials SBOM is. We looked at what it looks like, why it is used, and why it is used. Let's now look at the tool itself and how to use it, but it has some special features. Tool: cdxgen

Salute,

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 07 Oct 2025 00:00:00 GMT

Salute, There is an interesting conference going on right now that you can attend or play in the background. We are talking about the ITSec forum with an online broadcast on the topics “Optimizing tools for secure development processes.” Here I described the pre-roll for it. In t

"Brotherly, for our own"

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 07 Oct 2025 00:00:00 GMT

"Brotherly, for our own" #lol #backstage

VI/ VIM: some useful navigation, like structures

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 06 Oct 2025 00:00:00 GMT

🛠 VI/ VIM: some useful navigation, like structures I suddenly remembered something about vi/vim, nano, etc. As a result, working on vim is the most comfortable for me, practice still shows when I studied on the good old machines ubuntu, fedora, freebsd on a console/terminal. I d

What is copyright and DMCA practice (c)

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 06 Oct 2025 00:00:00 GMT

🤔 What is copyright and DMCA practice (c) Salute, Let's talk about what's useful for work and, in general, for any practice. In information security, we always talk about the Parker hexad (ownership, integrity, usefulness, availability, authenticity, confidentiality) as the main

Must-have: “simulator of an autistic programmer”

shmakovis@inbox.ru (Ilya Shmakov) — Sat, 04 Oct 2025 00:00:00 GMT

😂 Must-have: “simulator of an autistic programmer” You can play as a developer who is torturing society and work correctly, but now imagine that information security comes from the ground up? It’s already a little difficult for the guys, but most likely this is important, becau

AppSec tools: let’s talk about definitions

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 03 Oct 2025 00:00:00 GMT

🛠 AppSec tools: let’s talk about definitions Remark right away: Wow, I always come across misunderstandings about how tools work or their purpose, or a lack of interest to even google them. The feeling is still the same that AppSec and the DevSecOps process have been interested

"Come on, Uncle Fedya..."

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 03 Oct 2025 00:00:00 GMT

"Come on, Uncle Fedya..." #lol #backstage

DevSecOps is no longer an “add-on”, but a must-have for business

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 03 Oct 2025 00:00:00 GMT

🔥 DevSecOps is no longer an “add-on”, but a must-have for business In the RBC Trends article, I shared my experience, where we analyze why security has ceased to be “something for later” and has become part of the development itself. Remark: according to a study by Positive Tech

DevSecOps without filters: podcast on secure software development

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 02 Oct 2025 00:00:00 GMT

🎧 DevSecOps without filters: podcast on secure software development A new section without filters, embellishment and only to the point, The best part is that behind-the-scenes information security and real comfortable conversations about how to build secure development and not d

Wow, GuardConf 2025 is in full swing

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 02 Oct 2025 00:00:00 GMT

Wow, GuardConf 2025 is in full swing 😅 As a result, dears, I am at the base and already preparing to moderate my section @guardconf There will be a nice number of people, the hall will be packed along the way, but for now I’ll remind you who will be with me on the track: Andrey

Semgrep: custom as a feature and why do we start with it?

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 02 Oct 2025 00:00:00 GMT

🛠 Semgrep: custom as a feature and why do we start with it? Salute, let's begin I'd like to talk about Static Application Security Testing is an analysis method that checks static source code for vulnerabilities. This is a white box approach. Now let's look at the tool itself,

The fresh guy has arrived,

shmakovis@inbox.ru (Ilya Shmakov) — Wed, 01 Oct 2025 00:00:00 GMT

😅 The fresh guy has arrived, I plan to be a speaker at the conference 10/7/25 - “Optimizing tools for secure development processes.” An interesting conference that helps to listen to the non-trivial points of view of the guys in the market. We will discuss: • Practical cases of

By the way, there is a reminder from LANIT about the event that awaits us together on 2/10/2025 from 10:00. The discussion itself will take place from 15:00 to 16:00.

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 30 Sep 2025 00:00:00 GMT

By the way, there is a reminder from LANIT about the event that awaits us together on 2/10/2025 from 10:00. The discussion itself will take place from 15:00 to 16:00. 📍 Venue: LOFT#2, st. Leninskaya Sloboda, 26, building 11. Registration is required to participate. #conf #pmcas

SBOM: what is it and what is it for?

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 30 Sep 2025 00:00:00 GMT

🫡 SBOM: what is it and what is it for? Software Bill of Material is a file in JSON or XML format that includes an inventory list of all components (packages, libraries) used in the application being developed or necessary for its operation. The components SBOM specifies the pack

DevSecOps Toolchain Map

shmakovis@inbox.ru (Ilya Shmakov) — Tue, 30 Sep 2025 00:00:00 GMT

🛠 DevSecOps Toolchain Map Fireworks, I previously told you that I was preparing this toolchain map. Nowadays they are actively searching for it, as an example from Lukatsky, there is also a description of the process according to GOST 56939-2024 with an emphasis on risk analysis

“my mom says I’m special”

shmakovis@inbox.ru (Ilya Shmakov) — Mon, 29 Sep 2025 00:00:00 GMT

“my mom says I’m special” #lol

The first DevSecOps Hackathon in the Russian Federation: why did we do this?

shmakovis@inbox.ru (Ilya Shmakov) — Sat, 27 Sep 2025 00:00:00 GMT

😜 The first DevSecOps Hackathon in the Russian Federation: why did we do this? In 2024, he held the first DevSecOps hackathon in Russia from findevsecops.ru and @fintechassociation. Among the organizers were: Rosbank (so dear and beloved), RSHB, Yandex Cloud, Swordfish Security,

Information security risk analysis: why do we need risks?

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 26 Sep 2025 00:00:00 GMT

🥶 Information security risk analysis: why do we need risks? So let's get started This process - Risk Analysis, describes the practice of Shift Left (early involvement) at the design stages (we'll also see how this works later?), developing a technical solution and making change

Firework,

shmakovis@inbox.ru (Ilya Shmakov) — Fri, 26 Sep 2025 00:00:00 GMT

Firework, There's a cool event coming up here on October 2, namely GuardConf 2025 (@guardconf). I will act as a moderator in the secure development block and we will talk with the tops: Andrey Karpov PVS-Studio, Svetlana Gazizova Positive Technologies, Anton Volodchenko Codescori

“This is a quote, words full of wisdom that someone said importantly and can make the reader feel inspired” - someone from the greats.

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 25 Sep 2025 00:00:00 GMT

“This is a quote, words full of wisdom that someone said importantly and can make the reader feel inspired” - someone from the greats. #lol

WHOA! Who am I and why subscribe to this channel?

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 25 Sep 2025 00:00:00 GMT

🐱 WHOA! Who am I and why subscribe to this channel? Salute, My name is Ilya Shmakov, I am 30 years old. It so happens that I have more than 8 years of experience in information security for product development, design and implementation of code delivery security and specialize

Channel created

shmakovis@inbox.ru (Ilya Shmakov) — Thu, 25 Sep 2025 00:00:00 GMT

Channel created