Skip to content

An open logbook chained to a brass desk under a lamp, dense handwritten entries and diagrams, a clock and rolled drawings beside it

Reference

Lookup material. Nothing here teaches — it's what you open when you already know what you're after.

Planned pages

Page What it holds
Checklists Condensed, printable versions of the procedures in Operations and Incident Response
Tools What's actually worth running, by job: scanning, SBOM, secrets detection, log aggregation, IoC feeds, egress control. Free and self-hostable first
Glossary CVE, CVSS, EPSS, KEV, VEX, SBOM, IoC, TTP, and the rest of the alphabet, defined in a sentence each
Further Reading Books, standards, conference talks, and the advisories worth subscribing to
Sources Primary sources for every claim in this book

The companion books

This is one of three. They divide by the question they answer, not by topic — which means a single incident often has a chapter in more than one of them, viewed differently.

Where a topic lives

The boundary is the question, not the subject. Some worked examples, since "vulnerability" and "secrets" appear in more than one book:

Topic Build guide covers This book covers
SBOM What it is, formats, generating one at build time Matching it against a moving vulnerability database, forever
Vulnerabilities Choosing dependencies that have fewer Triaging the ones you already shipped
Secrets Keeping them out of the artifact and the repo Storing, scoping, and rotating them in a running system
Signing Producing and verifying provenance Detecting when something unsigned started running anyway
Pinning Why to pin, and to what Noticing that a pinned thing became vulnerable without changing

The short version: if the answer changes when you rebuild, it's the build guide. If the answer changes while you're asleep and nothing rebuilt, it's this one.