devopsy.kinsta.cloud

Tag: software development

5 Pillars of Successful Web App Development
Today, building a high-quality and competitive web application requires more than just clean code, a user-friendly UX and good development practices. The success of such a project also hinges on creating a strategic approach and prioritizing components that bring long-term value to both your business and your customer. The following five aspects — security, performance, user-centricity, scalability and cross-platform compatibility — define an efficient, future-proof app that will ensure high return on your tech investment.

In this article, experts from Itransition, a firm with 25+ years of experience in custom web app development, describe five key aspects you should concentrate on throughout the app development process.

Security

With cybercrime on the rise, companies should prioritize security in their web app development projects.

Recommendations
- Integrate Security in App Architecture Design
An app’s vulnerability is greatly determined by the reliability of its architecture. Therefore, development teams should factor-in security considerations at the project’s initial stages. To create a more secure architecture, teams should first identify cyber risks that can potentially affect the app in the future, by consulting business owners, IT teams and other stakeholders, reading industry-specific cybersecurity checklists and analyzing historical data on similar projects.

Guided by their findings, corporate security requirements and secure design principles, teams can define an optimal architecture structure to build an app that withstands cyber threats. To ensure that the chosen architecture is reliable before implementing it, teams should also conduct threat modeling to uncover hidden design flaws.
- Adhere to Secure Coding Standards
Make sure that the application’s code development process incorporates secure coding practices, such as input validation, static code analysis and version control. This can help minimize potential code vulnerabilities and guarantee that the app code is not susceptible to SQL injections, cross-site scripting and other types of attacks.
- Prioritize Security Testing
If you operate in a highly regulated industry, you should place a strong emphasis on security during the app testing phase. Consider allocating increased resources and efforts to penetration testing, vulnerability scanning, dynamic application security testing and other types of security tests to eliminate even the slightest possibility of costly breaches.

Performance

Software performance is another crucial aspect for consideration during web app development, as it directly affects user experience and satisfaction and determines the app’s success. As for enterprise web apps, slow performance, crashes and errors can also hinder business users’ ability to execute their tasks productively, leading to operational inefficiencies within your company.

Recommendations
- Design a Fail-Proof App Architecture
The underlying software architecture also significantly impacts application performance, so you need to choose architecture design patterns for applications carefully. For instance, to build a fault-tolerant solution, consider using a fault-isolated architecture with loosely coupled components such as a microservices-based architecture. This way, you can ensure that even if one component fails, it will not affect the entire system and the app will remain operational and available to users.
- Establish an Efficient Back-End Stack
The choice of programming languages, frameworks and tools used to build a solution’s back end also plays a key role in determining app performance.

Therefore, if you’re deciding between multiple alternatives that are relatively equal, consider opting for technologies known for their efficiency and speed. For instance, according to Sharkbench, Spring Boot, ASP.NET Core and Ktor can handle incoming requests within an app more quickly compared to FastAPI, Phoenix and many other frameworks.

User-Centricity

Attracting users and keeping them engaged with your app requires meeting their needs and expectations regarding functionality, usability or performance. Therefore, you should focus on users’ needs from the very beginning of your project and address them over its life cycle.

Recommendations
- Study User Pain Points, Behaviors and Motivations
To create a web solution that matches user interests, you should first gain a deep understanding of your users by learning their pain points, preferences and habits. Multiple techniques can come in handy in this regard, from one-on-one interviews and large-scale surveys to continuous observation of user behavior, each aimed at gathering different types of insights. Based on your research, you will be able to build user profiles representing the average users of your app and outlining their demographics, behavioral patterns, expectations, context of app use and other relevant characteristics.
- Create the App’s Prototype
Take into account the user insights generated earlier to decide on the capabilities that you want to include in your future app. Design efficient user flows and journey maps and build a high-fidelity prototype representing the preliminary version of the app. The team should then assess the prototype from different perspectives, together with a group of target users, to validate the design and functionality decisions. Based on the feedback, the team can refine the prototype until it fully addresses user expectations and then upgrade it to a successful full-fledged app.

Scalability

If your web app fails to accommodate an increasing or fluctuating number of users, data and transactions without performance or user experience issues, its growth potential can be limited. To be able to scale your app smoothly without costly modernizations, you must ensure software scalability from the project’s initial phases.

Recommendations
- Adopt a Flexible Software Architecture
The importance of your architectural design decisions cannot be emphasized enough, as they significantly determine whether your app can scale to meet increasing demands. Therefore, it’s essential to plan for app scalability from the very beginning.

For instance, you can focus on modularity during the design phase and opt for loosely coupled components, such as microservices, which can be scaled separately when needed. This approach enables dynamic and cost-efficient auto-allocation of resources to services experiencing high demand, which is impossible in rigid monolithic systems. This also allows teams to quickly deploy updates to individual services without the risk of causing downtime to an entire application.
- Consider Cloud Hosting Instead of On-Premise
If scalability is your top priority, consider hosting the web app in a cloud environment rather than your company’s on-site servers. After all, scaling software in the cloud is much easier and more cost-efficient compared to scaling it on-premise as you don’t have to invest time and resources into purchasing, setting up and maintaining additional hardware.

Cross-Platform Compatibility

If you aim to reach a larger audience and maximize your business’s revenue, you should also emphasize the cross-platform compatibility of your app. After all, a cross-platform web app can be accessed on any device with a web browser and also be uploaded to app stores, which means you don’t have to spend resources on developing multiple native apps.

Recommendations
- Choose a Suitable Platform-Agnostic Framework
To properly choose the development framework, begin by reviewing your unique project requirements. For instance, if you need reliable back-end technology well-suited for developing microservices, you can explore frameworks such as Symfony and Ktor. On the other hand, if you require an intuitive component-based framework for building user interfaces, you can consider Vue.js and React.js.

After identifying several frameworks that can potentially meet your needs, evaluate them from multiple perspectives such as performance, flexibility and development complexity, to gain a better understanding of each one’s strengths and weaknesses and make a final decision.
- Optimize Your Web App for Different Platforms
It’s vital to optimize a cross-platform web app for various platforms so that it can provide a consistent user experience across different devices and operating systems. In particular, teams should adhere to responsive design practices, including optimizing images, using flexible layouts and implementing CSS media queries to make sure that the web app can adapt to different devices and screen sizes. Teams should also follow platform-specific guidelines, such as Material Design for Android or Human Interface Guidelines for iOS, to ensure that their app provides a native feel.

Final Thoughts

Security, performance, user-centricity, scalability and cross-platform compatibility are the five essential elements of a successful web application. By focusing on these key pillars, developer teams can build more functional, reliable and easy-to-maintain apps that can deliver value to businesses for years to come.

If your in-house team lacks expertise in some of these aspects, your project should not necessarily be delayed or dismissed, as you can enlist the help of a web app development outsourcing firm instead. Professional third-party developers will help you design, build and implement a robust and future-proof web app smoothly and cost-efficiently.
November 6, 2025
DevOps Workflow: The Key Elements and Tools Involved
DevOps workflow is more than a work approach. It’s a corporate culture. It involves a range of practices that bridge software development (Dev) and IT operations (Ops). By doing so, it creates a uniform, continuous process without a gap between teams. As a result, it creates an environment with smooth collaboration, communication and shared responsibility.

In 2025, the global adoption rate of this culture is over 78%. Companies implement this methodology to ensure faster and more reliable delivery of services and software solutions with a higher quality of the end product.

If you’re also looking to adopt this philosophy or planning to start using services that work based on it, getting started can seem rather frustrating at first. This guide aims to help you by breaking down the modern DevOps workflow into the key components, practices and tools that need to be adopted for maximum smooth operations.

Continuous Development

The first essential element of the workflow is continuous development. It consists of two parts:
- Planning -The ongoing process of defining the quality factors and requirements for new solutions.
- Development – The continuous process of code writing, software development and unit testing to prepare solutions according to the existing plan.
In the regular work process, the planning and development stages are large and project-focused. In the development/operations culture, it’s an ongoing process. The development is handled in smaller cycles instead. And this helps ensure continuous software delivery and updates.

Continuous Integration

The next key component is DevOps continuous integration. CI is the process of continuous integration of code changes. The changes are usually produced by several contributors and frequently (often, several times a day) inserted into a central repository.

The most important element of this stage is automatic building and testing. CI implies that the solution is tested every time someone makes a change in the code. This practice allows smooth collaboration of several developers within a single project. It also keeps the codebase up to date, cuts down the cost of integration, and allows early bug detection and fixes.

Some of the most common DevOps workflow tools involved in CI include:
- GitHub Actions
- Jenkins
- GitLab CI
- CircleCI
Continuous Delivery and Deployment

In a DevOps workflow diagram, these stages mark the start of the operations process. This is where development and operations intersect.

It consists of two coexistent elements:
- Continuous delivery stands for making the code always ready for release after it has undergone the necessary changes and testing.
- Continuous deployment stands for automatic deployment of the delivered code. Simply put, it instantly goes into production when it’s stable enough, which ensures fast availability of new features and updates to users.
The CD process allows businesses to reduce manual intervention in the production and release processes, eliminating the need for scheduling when new features and releases will roll out. Respectively, it allows a faster time to market for each solution.

Some of the main DevOps automation tools used at this stage include Spinnaker, ArgoCD and Harness.

Infrastructure as Code

IaC is among the DevOps best practices. Its goal is to simplify the management of your company’s IT infrastructure. Simply put, IaC cancels out manual processes of provisioning and management of your networks, storage, servers, and other infrastructure elements and replaces them with automation. Instead of manual tasks, come code and configuration files.

By changing the way they create and maintain their environments, teams can eliminate the possibility of human-made errors. But that’s not the only benefit of this approach. It also creates safe and repeatable management procedures. These make it easier to scale projects. And it also offers greater reliability and quality.

Quality Assurance and Automated Testing

As was mentioned earlier, testing is a pivotal part of the CI and CD pipelines. And it’s also one of the major components of DevOps workflow automation. Automatic testing is applied throughout the entire CI/CD stages to assess the stability and performance of the solution after each change has been made. There are a number of test types that are involved in this process, including unit, integration, end-to-end, and regression testing. But that’s not all.

Beyond the software performance testing after code changes and pre-launch, many teams also integrate pre-release testing of their marketing efforts and SEO, in particular. What does that mean? You can use DevOps automation to run audits of your solution’s/app’s accessibility and SEO to see how well it will perform in SERPs. This is important to ensure that your software will be visible to potential users in search engines when it rolls out.

Furthermore, in today’s online landscape, it also makes pretty good sense to perform additional checks of your visibility in AI search. Since more and more people are using AI-powered engines and tools to research information, being included in generated results is a good way to secure overall visibility. You can do this with the help of a specialized AI search visibility tool.

All in all, using diverse DevOps workflow tools for automated testing will help you detect issues before you get into the production stage or release your solution. This way, you can safeguard UX and business KPIs.

Logging, Observability and Monitoring

Your workflow doesn’t really stop even when the solution is released. The post-production and release stage is all about ongoing assessment of the solution’s performance and improvement.

It consists of three elements that can work simultaneously:
- Monitoring is about tracking performance in real time.
- Logging stands for keeping a well-documented log of all events that require troubleshooting.
- Observability is about collecting deeper insights into the state and stability of the system through various logs, metrics and traces.
What is it all aimed at? It’s all about keeping an eye on any arising bugs and issues. This is crucial to respond to incidents quickly and secure an all-time positive UX.

Common DevOps tools leveraged at this stage include Grafana, Datadog, Prometheus and others.

Collaboration and Communication

As you now see, this culture is all about establishing a smooth and integrated work process that implies the performance of many simultaneous tasks by multiple contributors. Furthermore, it implies mutual and well-defined work of teams from different departments. Hence, this methodology is just as much about your in-house culture as it is about technical aspects of the product’s lifecycle.

There are two cultural aspects in the heart of an effective workflow:
- Collaboration
- Communication
Companies need to integrate effective collaboration solutions. These include shared dashboards, regular meetings, clear documentation and async communication. This should help ensure that everyone involved in the project is on the same page. It should also allow effective interactions across all team members, regardless of their schedules or time zones. This is particularly important for large teams.

To accomplish all of this, teams need to adopt efficient DevOps tools meant for collaboration. Currently, common picks include Jira, Trello, Slack, Microsoft Teams and others.

Security Integration

While DevOps is primarily focused on software quality and fast delivery, security is something that can easily slip through the cracks in the production process. In this case, leading companies bring together DevOps and security and turn their software supply chains into DevSecOps.

What does this mean? Speaking simply, this approach is based on the same fast-moving development and operations pipeline, but that also has mandatory security processes in it. This implies regular and automated vulnerability scans and dependency checks, as well as compliance automation and secret management. This helps detect security breaches early and ensure complete compliance to build and maintain user trust.

Continuous Improvement and Feedback Loops

Ongoing measurement and improvement are the two core principles of a DevOps culture. It’s important to understand that it’s not only about the delivery speed, but actually about positive UX and impeccable quality. That’s why the last two elements of a modern workflow under this culture are feedback loops and continuous improvement.

There are a few things involved in the process. First of all, feedback loops should be both internal and external. Internal loops contain regular and detailed feedback provided by in-house teams – including development, operations and Quality Assurance (QA). External feedback is collected from customer support logs and end-user telemetry (the data collected remotely from users’ devices and applications to assess real-world UX).

Both internal and external feedback loops have a shared goal—to detect issues and areas for improvement that need further attention. Such a continuous improvement approach allows for fast issue resolution, customer-centric development and improved UX.

DevOps automation is also present at this stage of the workflow. At this point, teams can use feature flagging platforms, such as LaunchDarkly. This platform allows automatic rollback of problematic features, has A/B testing functionality and easily integrates with your communication solutions, such as Slack.

Conclusion

DevOps is more than just a workflow organization pattern. It’s a culture built around firm principles of collaboration, communication, automation and continuous improvement. A combination of these principles allows us to create a smooth and efficient workflow that doesn’t just offer fast product delivery, but also helps ensure the best UX and constant growth.

With this guide, you should now have a better understanding of the key elements involved in this process, as well as the key DevOps workflow automation practices and tools. Use this knowledge to build a collaborative environment that drives success!
November 4, 2025
Sonar Previews Service to Improve Quality of AI Generated Code

Sonar today provides a service that promises to improve the quality of the code generated by large language models by significantly reducing the number of security vulnerabilities and bugs created.

Designed to be used by organizations that are training artificial intelligence (AI) models, SonarSweep discovers issues in code that can then be used to retrain an AI model to identify and eliminate.

Harry Wang, chief growth officer for Sonar, said that approach can reduce the number of cybersecurity vulnerabilities and the number of bugs created by as much as 67% and 42%, respectively.

Beyond the providers of foundational models, it’s not clear how many organizations are distilling their own AI models to write code, but as AI continues to evolve, there will soon be many more smaller language models that will be trained using code that has been vetted by an internal application development team.

Currently, the quality of the code generated by LLMs can vary widely. Most of them have been trained using examples of code that often contain vulnerabilities and bugs that are then randomly replicated within the code generated by an AI tool. DevSecOps teams are then tasked with reviewing that code to eliminate these issues before code is deployed in a production environment. However, as more code is generated by AI coding tools, the volume of vulnerabilities and bugs that need to be discovered and remediated can quickly become overwhelming.

SonarSweep addresses that issue by systematically applying reinforcement techniques to remediate, optimize, and secure coding datasets used to train models, said Wang.

That capability also significantly reduces the total cost of training AI models because organizations will be able to use earlier versions of LLMs versus, for example, using a ChatGPT 5 model that, while improving the quality of the code generated, also generates more complex code, noted Wang.

The SonarSweep service itself is based on an AI code review platform the company developed that is already being used to analyze 750 billion lines of code each day for more than seven million developers that build applications for more than 400,000 organizations, including Barclays, MasterCard and T-Mobile. Sonar already supports more than 35 programming languages, which SonarSweep will be extended to support as the service continues to evolve, said Wang.

Hopefully, the quality of the code being generated by AI coding tools will substantially improve in the months and years ahead as foundational AI models continue to improve. In the meantime, each DevOps team will need to evaluate the degree to which it might make financial sense to build its own smaller language model for specific use cases in, for example, a vertical industry sector. While the cost of building and maintaining those models can be significant, larger enterprise IT organizations clearly have the resources to build AI models that they can employ to generate code with greater confidence, noted Wang.

Regardless of approach, the one thing that is clear at this point is that AI tools that generate more flawed code than ever are quickly becoming too much of a potentially good thing.

October 21, 2025
Survey Sees Developers Embracing AI Faster than Project Leaders

A survey of 1,129 developers and 50 project managers suggests that individual developers are significantly further ahead when it comes to embracing AI than managers of application development projects.

Conducted by BairesDev, a provider of software development services, the application developers surveyed said they are now saving on average 7.3 hours of work per week, or roughly an entire working day, with AI being used to create 25% of the code they develop.

Primary AI benefits include faster coding (65%), accelerated learning (48%), increased productivity (45%), faster prototyping (34%) and better code quality (27%), the survey finds.

Additionally, a full 88% also said they now view AI as a gateway to creating new career opportunities, with 76% believing AI makes their work more fulfilling. Key opportunities identified include automating grunt work to free up time for architecture and problem-solving (62%), specializing in AI/machine learning (45%), and prompt engineering (44%).

Most of those developers are currently using on-the-job training (66%), YouTube (58%) and paid online courses (48%) as the top ways they acquire new AI skills. Only 15% said they use formal certification programs as a way to upskill versus self-learning. However, 44% said they would like to receive AI- and machine learning-related training.

BairesDev CTO Justice Erolin said that as the pace of technological change accelerates, a hands-on, proactive mindset becomes increasingly essential. However, real progress occurs when this self-directed learning is paired with structured upskilling and reskilling programs that provide depth, validation, and long-term growth, he added.

Unfortunately, project managers are not as far along when it comes to embracing AI. The top three challenges identified are gaps in business/context knowledge (43%), shortage of AI/ML specialists (41%) and lack of internal upskilling programs (38%). Only 15% of project managers report having structured AI upskilling programs.

Project managers also noted there is a lack of clarity about the actual return on investment (ROI) clarity (38%), concerns around data privacy and security (38%) and limited resources (36%).

It’s still early days so far as adoption of AI in software engineering is concerned but it’s now clearly a matter of the degree to which it will be applied rather than if. The core issue is determining what level of faith to place in the output generated by these tools, especially as it pertains to potential vulnerabilities and the amount of technical debt that might be incurred because of how verbose the code is.

Nevertheless, it’s also apparent that AI coding is only going to continue to improve and there are plenty of use cases where the code being generated sufficiently meets the immediate need at hand. Regardless of the use case, however, that code needs to be reviewed before being included into any production environment to reduce the number of potential issues that might be encountered later on.

In the meantime, leaders of DevOps teams would be well-advised to gain some hands-on AI experience of their own to better understand what type of additional training might be needed. After all, in the age of AI it’s simply not going to be possible to lead from the rear given the rapid pace of change occurring now on an almost daily basis.

October 17, 2025
Strengthening Software Trust in Modern DevOps Workflows

At swampUP 2025 in Napa Valley, Alan Shimel sat down with Tariq Shaukat, CEO of Sonar, and Gal Marder, EVP of Strategy at JFrog, for a discussion on how partnerships across the DevOps and AI ecosystems are reshaping the way software is built, secured and delivered.

Shaukat emphasized that Sonar’s relationship with JFrog is rooted in shared values around trust, transparency, and code quality. As AI continues to accelerate software creation, both companies see a growing need for solutions that help developers not only move faster but also maintain the highest levels of security and reliability. “It’s never been about how fast developers type,” Shaukat noted. “It’s about ensuring that what’s being built is safe, verifiable, and ready for production.”

The discussion also touched on the rising influence of AI in DevOps workflows and the responsibility that comes with it. Shaukat and Marder agreed that as teams adopt AI tools to generate, test, and deploy code, governance must evolve to keep pace. That’s where the partnership between Sonar and JFrog becomes especially relevant—bridging code integrity with artifact management, vulnerability detection, and software supply chain security.

Marder added that this collaboration exemplifies JFrog’s broader strategy to build a unified, secure DevOps ecosystem powered by trusted partnerships. Together, Sonar and JFrog are working to redefine how software quality and trust are measured in an era where AI agents, automation, and human developers all share the same pipeline.

October 14, 2025
The EU’s Cyber Resilience Act: Redefining Secure Software Development
The European Union’s Cyber Resilience Act (CRA) marks a turning point for anyone building, selling, or maintaining digital products. Whether it’s enterprise software, consumer apps, IoT devices, or embedded systems, the CRA sets rigorous cybersecurity requirements that apply throughout a product’s entire lifecycle, from design and development to deployment, maintenance, and secure decommissioning.

At its core, the CRA is about security-by-design. It mandates transparency, robust vulnerability management, and secure updates backed by enforcement mechanisms such as CE marking, machine-readable Software Bills of Materials (SBOMs), and compliance documentation.

Why You Need to Start Now

The CRA fundamentally redefines how software will be built and maintained, pushing organizations to adopt more structured, transparent, and security-centered development strategies. And if you’re like most commercial software developers who incorporate open source components, you’ll need to account for your dependencies. Your team will need time to adapt development and security workflows to meet these new expectations.

The timeline for CRA compliance is already in motion:
- December 2024 – The CRA came into force. This marked the start of the transition period for all affected stakeholders.
- September 2026 – Early obligations take effect, including mandatory vulnerability reporting to EU authorities, specifically the European Union Agency for Cybersecurity (ENISA).
- December 11, 2027 – Full enforcement begins. By this point, stakeholders must be ready with machine-readable SBOMs, secure update mechanisms, and detailed compliance documentation for every applicable product.
And, it’s important to note that the consequence of non-compliance isn’t just a fine. It can mean being locked out of the EU market entirely.

Roles and Responsibilities Under the CRA

Before we jump into the actual impacts of these regulations, let’s take a moment to clarify the different roles and responsibilities in the software development process. In its latest iteration, the CRA clarifies distinct roles and who’s accountable within the open source ecosystem:
- Manufacturers: Any entity placing a product (including those built from OSS) on the EU market. They bear full legal responsibility for security throughout the software lifecycle.
- Open Source Stewards: Newly defined economic actors, such as those who systematically support an open source project as a sustained offering intended for commercial use.
- Maintainers/Contributors: Individuals or teams engaged in development. Generally, they are not directly bound by CRA obligations, unless acting as stewards or manufacturers.
This structured distinction allows the CRA to exempt casual contributors while focusing legal accountability on downstream producers. However, even though maintainers may not face direct enforcement, the realities of dependency chains mean they must adapt. For example, many manufacturers will insist on robust security hygiene, transparency, and responsiveness from upstream projects. As a result, maintainers will find themselves needing more structured workflows, clarity on vulnerability handling, and easier collaboration pathways.

Specific Obligations for Organizations Building Software

Clearly, manufacturers face the greatest burden in this scenario. But what exactly are they responsible for? Under the CRA, manufacturers of all sizes, including software publishers, must:
- Generate a machine-readable SBOM listing, at a minimum, top-level dependencies.
- Keep SBOMs updated and provide them to market surveillance authorities upon request.
- Maintain vulnerability handling frameworks, including having a public channel for reporting and a quick remediation pipeline.
- Apply secure updates, ideally over-the-air, and separate them from functional updates.
- Share patches upstream for OSS components they use, fostering better ecosystem security.
Non-compliance with the CRA can come at a high cost. Fines may reach €15 million or 2.5% of global annual turnover, whichever is higher. Some responsibilities that were previously optional, such as sharing patches with upstream projects, are now required. This shift means organizations need to reassess how they handle compliance across the software lifecycle. That includes generating and maintaining SBOMs, securing CI/CD pipelines, improving vulnerability scanning, and strengthening patch management processes.

Impact on DevOps Teams

So, what does this mean, precisely, for those of us building new software? For DevOps practitioners, the CRA’s broad and deep mandates mean applying security across both processes and toolchains. DevOps teams will need to:
- Incorporate SBOM generation and management for all PDEs (Products with Digital Elements), continually updating them.
- Establish or enhance vulnerability disclosure mechanisms and incident reporting channels, including timely communication with relevant authorities such as ENISA.
- Ensure secure, streamlined software updates, preferably separated from feature updates, and automatic where feasible.
- Conduct software risk analyses, enforce code integrity (e.g., through signing), encrypt data streams, and maintain documentation for extended periods (up to 10 years or the product’s support lifespan).
These new requirements are pushing many organizations to modernize how they build and ship software. Instead of treating the CRA as just another checklist, forward-looking teams see it as a chance to strengthen security across the entire development process. That means improving how dependencies are managed, automating SBOM generation, tightening vulnerability response, and separating security updates from new features. When done well, these changes don’t just satisfy compliance requirements. They also reduce technical debt, improve long-term resilience, and help build trust with users and partners. In many cases, preparing for the CRA can be the push teams need to develop software that is more secure and easier to maintain.

Turning to the Community for Guidance

Few regulations have created as much industry-wide urgency for practical guidance as the CRA. Small- and medium-sized enterprises (SMEs) are particularly vulnerable, as they often lack the compliance resources of their much larger counterparts.

The good news: the industry is responding. The Open Regulatory Compliance (ORC) Working Group, hosted by the Eclipse Foundation, was created to develop actionable resources and collaborate with government agencies to help organizations comply with regulations, such as the CRA.

Backed by neutral governance, strong ties to standardization bodies (CEN, CENELEC, ETSI), and liaison to the EU’s CRA experts, ORC includes more than 50 members and is rapidly growing. This diverse group brings together global technology companies like Nokia, Mercedes‑Benz, Microsoft, Red Hat, GitHub, and Google, more than 20 open source foundations, and a growing number of SMEs working together on practical solutions.

This cross-industry, open source–friendly initiative is helping developers, enterprises, and open source communities navigate this evolving regulatory landscape with clarity and confidence. ORC provides a collaborative platform to share relevant resources, including specifications, best practices, and reference materials, and serves as a trusted forum for dialogue with regulators, standards bodies, and industry stakeholders. With its depth of expertise and commitment to open source values, ORC is uniquely positioned to shape a practical, balanced path to CRA compliance.

The Time to Act is Now

With the first CRA obligations taking effect in September 2026 and full enforcement by December 2027, the window for preparation is narrowing quickly. While some regulatory details are still being finalized, the direction is clear. Now is the time to align your development workflows, build compliance into your pipelines, and contribute to the broader conversation shaping how these rules will apply in practice.

ORC is one example of how the open source community is coming together to tackle these challenges collectively. By sharing resources, expertise, and practical tools, ORC is helping organizations of all sizes prepare for CRA compliance without sacrificing agility or innovation.

The CRA is more than just another set of rules. For DevOps teams and software professionals, it’s a chance to make security a built-in part of everyday work. This isn’t only about meeting legal requirements. It’s about helping shape a software ecosystem that’s easier to trust, easier to maintain, and better for everyone involved.
August 26, 2025
Survey Attributes Massive Economic Gains to Rise of AI in Software Development

A global survey of 2,786 C-level executives finds organizations are saving $28,249 per developer annually due to investments in artificial intelligence (AI), in part thanks to a 48% increase in developer productivity.

Conducted by The Harris Poll on behalf of GitLab, 58% of respondents report their organization has experienced business growth tied to software innovation efforts over the last 12 months, resulting in an estimated 44% increase in revenue.

A total of 91% of respondents also noted that the board of their organization has adopted the benefits of software innovation, with 82% reporting a willingness to invest over half of their company’s annual IT budget in prioritizing software innovation. A full 90% have adopted frameworks linking software development activities to key business outcomes.

The most common metrics used today to measure software innovation success are increased business growth (40%), improved problem-solving capabilities (40%), and enhanced developer productivity (39%).

Emilio Salvador, vice president of strategy and developer relations for GitLab, said the survey results make it clear that the economic impact AI is having on software development is profound. However, 90% of respondents said that despite these advances, their organizations continue to hire application developers to increase the pace at which applications are being developed, he added.

In fact, 91% report that software innovation is now a core business priority, with 89% expecting agentic AI to become the industry standard for software development within three years. Most of the reliance on those AI agents will be to not just write code but also offload tasks such as testing, noted Salvador. As a result, developers will have more time to focus on the problems they are trying to solve, as opposed to performing a range of manual tasks that take time away from building software, he added.

The human touch will also continue to be needed to build high-quality applications, said Salvador. Nearly all (99%) respondents, for example, noted that human contributions are still valuable for software development, with 73% noting the human-AI partnership should be at least 50/50; compared to 27% that said AI should do the majority of the work. Creativity (39%) and strategic vision (39%) are ranked as the most valued human inputs.

Despite the current level of appreciation of the value of AI, the survey also makes it clear that there are challenges and concerns to be addressed. Topping the list of concerns around the adoption of agentic AI, for example, are cybersecurity threats (52%), data privacy and security (51%), and maintaining governance (45%). More than half of respondents (53%) are implementing regulatory-aligned governance measures, with a nearly equal percentage (52%) developing internal AI policies. A total of 47% are already relying on third-party audits of AI usage, the survey finds.

Other challenges that organizations will ultimately face will include an expansion of the number of DevOps pipelines that will need to be managed as the amount of code being created continues to increase, noted Salvador.

Finally, organizations should not overlook the need to retrain software development teams, many of which may soon include citizen developers using vibecoding tools to rapidly build prototypes of applications, he added. A total of 92% of respondents also noted that businesses should prioritize training employees to work alongside agentic AI to address skill gaps, the survey finds.

It’s not clear just yet how much application development will be accelerated in the age of AI, but the one thing that is clear is that no aspect of how software is built, updated, secured and managed will be left untouched. The only thing left to determine now is how quickly this transition to relying more on AI to build applications is going to occur.

August 5, 2025
GitGuardian Humanizes Non-Human Identity Controls Inside Developer Workflows

As the ubiquitous rise of agentic AI services continues to surge, spread and scale, the need to provide teams with ancillary extensions and connections to Model Context Protocol (MCP) appears to now be equally obligatory. An equal consideration for both developer and operations counterparts inside modern DevOps team environments, the need to build, test, lock-down and subsequently manage, monitor and optimize application connections to agentic AI services is of paramount importance.

Developed by Anthropic, MCP provides AI services with a way to access and interpret the appropriate context for any given system interaction. It does this by connecting AI models and execution engines with the correct system components, tools and data sources they need to perform their functions securely and efficiently.

When developers first build services drawing upon data repositories and services that agentic tools will use, operations teams will then be faced with a continuous delivery responsibility to ensure system connections are sound, secure and solid. Existing as a kind of combined DevOps traffic light and GPS route map system for agentic injection, latest to pledge allegiance to the MCP mantra is GitGuardian, a non-human identity (NHI) security, automated secrets detection and remediation company.

More MCP, If You Please

The organization has now detailed its Model Context Protocol (MCP) Server as a new infrastructure service designed to bring AI-assisted secrets security directly into developer environments. As intelligent agents begin to reshape the software development landscape, GitGuardian says its end-to-end NHI and secrets security platform empowers human beings working in software-driven organizations to enhance their non-human security and comply with industry standards.

Potentially classed as a sub-discipline of network management for DevOps security practitioners, secrets management involves the protection of “secrets,” including passwords, encryption keys, API keys, database credentials, user credentials, secure socket shell (SSH) keys and short-lived credentials used for authentication and authorization, such as tokens.

In short, a secret is any piece of data that forms part of an application security fabric to allow applications and services (or higher-level operating systems or lower-level APIs) to authenticate and authorize users or machines with access to resources.

Injected Honeytokens, Sweet!

GitGuardian says its MCP server enables DevOps teams to detect, respond to and remediate security incidents as code is being written. It allows developers to scan code, manage incidents and “inject honeytokens” directly from AI-enhanced IDEs like Cursor and Windsurf. This approach compresses the traditional security feedback loop, from commit to alert to fix, into minutes.

For completeness here, let’s remember that honeytokens are smaller second cousins to honeypots. A honeypot is a fully blown decoy system (the size of an application server, upward to a server or even a network) fabricated to attract malicious actors in order to observe their behavior and interactions. Logically, then, a honeytoken is a smaller unit of data that is placed inside a dataset, application or other service to also entice attackers and understand their attack vectors and patterns.

“This is a new security primitive,” said Eric Fourrier, co-founder and CEO of GitGuardian. “By launching our MCP server, we’re enabling agents to take proactive, context-aware security actions directly in the development environment. Developers no longer need to wait for delayed alerts or decipher vague ticket instructions. Security now happens as they code. The GitGuardian MCP Server acts as a command center that allows AI agents to read from and orchestrate tasks across the organization’s broader security ecosystem.”

Intelligent Agents Command Hub

Fourrier and team say that teams using this technology will see that agents can now automatically scan files pre-release, identify and remediate hardcoded secrets and inject honeytokens into code for early breach detection. Built with read-only permissions by design, GitGuardian’s MCP Server minimizes security risk while maximizing utility. It ensures agent behavior is safe, supervised and auditable.

“We’re not just pushing data to IDEs,” said Mathieu Bellon, senior product manager at GitGuardian. “We’re giving intelligent agents the tools and context they need to take action responsibly and securely, directly within the developer’s workflow. The MCP Server is compatible with any IDE or platform that supports the Model Context Protocol (MCP). With these capabilities, security becomes a collaborative, real-time experience for developers so that there is no more context switching to external tools, no more reactive security loops and no more ambiguity around incident ownership.”

Perfect Posture?

Developers and wider DevOps teams are promised the ability to gain agency over their security posture with tools tailored to their environment and pace. Both Fourrier and Bellon insist that secrets sprawl remains one of the most pervasive and underestimated security threats today. Hardcoded API keys, credentials and tokens can lead to costly breaches if not identified and remediated quickly.

“The rapid rise of intelligent development tools like Copilot, Cursor, Windsurf and Claude has further fueled the explosion of non-human identities and hardcoded credentials scattered across codebases, wikis, CI pipelines and collaboration platforms. Traditional security tools are not keeping up,” say the pair. “By embedding secrets detection and response within the development pipeline, GitGuardian’s MCP Server offers a transformative approach to reducing security risk without slowing development velocity.”

Humanizing Non-Human Controls

In an age when DevOps practitioners need to know their NHI from their MCP APIs, it could well be time to humanize the practice of non-human identity security management.

July 16, 2025
Fast Code, Real Risks: Guardrails for AI-Generated Software

Yonatan Arbel, developer advocate in the Office of the CTO at JFrog, dives into the potential risks and rewards of relying on artificial intelligence (AI) agents to build and deploy software.

Yes, more code is shipping faster than ever, Arbel admits, but volume alone isn’t a win—each hastily synthesized line must still survive build servers, security scanners and production reality. “Not everything in life comes for free,” he reminds, framing AI acceleration as an IOU that must eventually be paid down with careful review.

To drive the point home, Arbel shares a personal misadventure. While traveling, he used a “vibe-coding” platform to whip together a receipt-tracking app. The tool auto-generated an impressive login flow and slick UI, so he proudly shared the URL with friends—only to discover their receipts mixed with his the next morning. A quick code dive revealed an AI-written SQL query that fetched every user’s data instead of scoping to the current account, proving how easily privacy can be breached when humans skip the boring inspection step.

From there, the conversation turns to guardrails. Developers are becoming “pilots with copilots,” Arbel notes, spending more time instructing chat windows than writing functions. That shift demands automated policy checks, dependency vetting and runtime governance so velocity doesn’t eclipse trustworthiness. DevOps teams must embed quality gates early and often, treating AI-generated packages and prompts just like any other third-party code subject to organizational rules.

Arbel’s advice is pragmatic: Start small, review everything, and remember that speed without oversight is just a fast track to technical—and financial—pain. Used thoughtfully, AI can compress months of work into days, but only if teams stay vigilant, enforce context-aware policies and let security evolve in lockstep with the bots.

June 30, 2025
Atlassian Adds CLI Option to AI Agent for Building Software

Atlassian has added a command line interface (CLI) option to provide application developers with a familiar construct for invoking Rovo Dev, its artificial intelligence (AI) agent for building software

Part of a portfolio of Rovo Software Agents that Atlassian now makes available in beta, Rovo Dev completes and debugs code, creates tests, surfaces insights and explanations of code bases, makes suggestions to improve code and generates documentation. It is also integrated with Jira project management software and Confluence collaboration tools provided by Atlassian.

Using a set of software engineering (SWE) benchmarks maintained by researchers at Princeton and Stanford, Rovo Dev achieved a 41.98% resolve rate across 2,294 tasks.

It can also be integrated via a Model Context Protocol (MCP) Server to access external data sources capable of providing more context that might be needed to complete a specific task.

Shuyin Zhao, vice president of product for Atlassian, said the goal is to provide a single agent capable of performing a wide range of tasks versus requiring developers to create workflows that require them to orchestrate multiple agents to build and deploy software. The more memory that can be allocated to an AI agent the more it is able to preserve context, she added.

Longer term, as the reasoning capabilities provided by large language models (LLMs) continue to expand, the scope of complex tasks that can be assigned to that AI agent will also increase, noted Zhao.

Eventually, many developers will find they will be spending more time reading and evaluating code rather than writing it themselves, she added.

It’s not clear how widely AI tools are being adopted by software developers and engineers, but a Futurum Group survey found 41% of respondents expect generative AI tools and platforms will be used to generate, review and test code. The one thing that is certain is more developers than ever are using these tools to write code, but how much of that code is making it into production environments is unknown. In some instances, an AI tool might enable a developer to write better code than they can on their own. In other instances, it might create vulnerabilities or recommend using software packages that simply don’t exist.

Additionally, even as more code is generated, the existing DevOps pipelines might not be robust enough to deploy software at higher levels of scale than what is already being achieved.

None of that means AI agents won’t be incorporated into DevOps workflows, but it does mean there is still a considerable amount of effort required to re-engineer those processes in a way that is optimized for AI agents rather than human application developers.

In the meantime, however, DevOps teams would be well-advised to start creating a list of tasks they are willing to delegate to AI agents, assuming there is some level of supervision. Otherwise, it’s all but inevitable that AI agents might generate the same issues that human developers create, albeit just at a different level of scale. The issue then becomes making sure the right governance policies are in place to prevent as many of those issues from arising in the first place.

June 18, 2025