Blog
Field notes from the Driftlock engineering desk.
Short posts on the questions platform-security leads at regulated orgs ask first: what an async coding agent has to leave behind on the pull request, where in-IDE assistants and full delegations break the audit-trail bar, and how Driftlock's signed commits, SBOM entries, and sandboxed runs close the gap.
Cadence
Posts land as the engineering work produces an artefact worth writing up — irregular, but never silent for long.
Shape
Argument-shaped, not list-of-rows: each post names a problem, names the alternative approaches, and shows how Driftlock closes the gap.
Permalinks
Every post has a stable /blog/<slug> URL and a canonical link in its rendered metadata, so it can drop into Slack or a regulator's evidence binder.
Posts
Every post, in order.
The newest post lands at the top. Older posts stay in place below it — the index reads as an append-only timeline rather than a curated highlight reel.
August 21, 2026
2026-08-21SBOM drift automation for platform engineers: catching dependency divergence before the auditor does.
Most platform teams run a quarterly SBOM export and call it supply-chain hygiene. The auditor arrives with a diff that reads differently — per-PR lockfile deltas, not batch snapshots. Continuous CycloneDX emission with a cosign signature per PR is the only posture that closes the gap between "we generate SBOMs" and "our SBOMs are auditable".
August 14, 2026
2026-08-14How to automate monorepo dependency upgrades without breaking CI.
Batched Dependabot / Renovate PRs are the default in a monorepo, and they are the wrong default: a failing test flips a hundred open PRs the same red, reviewers cannot tell which is the real one, and the diff that lands is rarely the diff the auditor replays. Reproduce the failing test first, replay it in a hermetic sandbox before the diff lands, and sign the commit over (commit_sha || sbom_sha256) so the PR is reviewable and replayable in one go.
August 14, 2026
2026-08-14SBOM generation for monorepos: CycloneDX vs SPDX compared.
Both standards serialize the package inventory of a build; the question is not which one is "right" so much as which one fits what is downstream. CycloneDX gives regulators depth per package and per-PR SBOM diffs by design; SPDX gives you cross-tooling coverage and an ISO anchor in the format itself. Most regulated monorepos emit CycloneDX primary, with the same document landing as an SPDX handled-link bridge for the tooling that prefers SPDX over CycloneDX. /docs/compliance and /architecture walk both sides in the vocabulary the security review board actually reads.
August 6, 2026
2026-08-06What every audit-linked PR carries in its SBOM — and why a regulated buyer cares.
Every audit-linked PR ships a CycloneDX SBOM, signed with the customer's KMS key, hashed against the lockfile, anchored in the same ledger row as the approver chain. Here is what a SOC 2 / FedRAMP reviewer actually reads from it.
August 3, 2026
2026-08-03Closing the audit-trail bar that async coding agents miss.
Platform leads at regulated orgs ask three things: a per-PR record row, a signature over the commit, and an SBOM a downstream tool can ingest. In-IDE assistants do not produce them, and full delegations break them. Driftlock ships all three on every audit-linked PR.
reverse-chronological · permalinkable · argument-shaped
Want the compliance pack?
Pair the blog with the governance explainer and the SOC 2 pack.
The posts above argue the case for Driftlock's audit-trail bar; the governance page enumerates the seven columns a regulator replays; the compliance pack ships the SOC 2 Type II report and the air-gapped deployment runbook under NDA. Drop your buyer email below and we'll send the pack within two business days.
Get the compliance pack
Buyer or platform-security email only — no follow-up sequence, replies come from the same inbox that scoped your trial.