┌──────────────────────────────────────────────────────────────────┐
│  SHIFT LEFT  ·  SUPPLY CHAIN SECURITY  ·  DEVEX-FIRST APPSEC     │
└──────────────────────────────────────────────────────────────────┘

Senior Product Security Engineer @PayPal

Security that developers actually want to use — not security they route around.

I got into security through automation, not through breaking things by hand. My first job was building the scanners and detection logic that other people's pentest findings fed into — and that vantage point taught me something early: a finding that lives in a PDF report is a finding that gets fixed once and forgotten. The same class of bug would resurface in a different repo six months later. The vulnerability wasn't the real problem. The workflow around it was.

That's the thread running through everything I've built since — at IKEA, at Tekion, and now at PayPal: if a security control creates friction, developers will find a way around it, and the org is worse off than if the control never existed. So instead of shipping policies, I ship platforms — things that sit inside the pipelines developers already use, catch what matters, and stay quiet about the rest.

   DEVELOPERS                    SECURITY TEAM
   ──────────                    ─────────────
   "Ship the feature,           "Block anything
    the deadline is Friday"      non-compliant"
        │                              │
        └──────────── FRICTION ────────┘
                        │
                        ▼
          alert fatigue · shadow IT · shipped anyway
                        │
              I build the layer in between:
        gateways, not gatekeepers · signal, not noise
                        │
                        ▼
        SECURE BY DEFAULT, INVISIBLE UNTIL IT MATTERS

Alert fatigue is the real enemy, not the CVE count. A scanner that cries wolf on every transitive dependency trains people to ignore it — and then it misses the one that matters. Most of my work is about compression: taking a firehose of findings and turning it into the handful of things a developer needs to act on today.

One of the more interesting weeks this year: catching and neutralizing Shai-Hulud, a self-replicating npm worm, along with a handful of concurrent supply-chain campaigns — before they could steal credentials or spread through build environments.

AppSec & Supply Chain      Container / Cloud         Automation & Detection
──────────────────────     ─────────────────         ───────────────────────
Semgrep · CodeQL           Trivy · Wiz · JFrog Xray   Python · Bash
Dependabot · Renovate      Docker · Kubernetes        GitHub Actions
Syft (SBOM)                GCP · AWS                  GitLab CI/CD
Gitleaks · GHAS            Nuclei · ZAP · Burp        Harness CI/CD

Most of these exist because I got tired of asking "does a tool for this already exist?" and just built the version I wanted.

I write about the gap between "the scanner found it" and "the developer fixed it" — shift-left tooling, supply chain security, and what it actually takes to get 700 teams to care about security without forcing them to.

🔗 blog.shivamsaraswat.com

If you're working on supply chain security, container security, or building security tooling people don't hate — open an issue, or find me on LinkedIn.

"A control nobody uses isn't a control — it's a checkbox."