Ep 58 - Stop Blocking PRs, ProdSec Should Inform and Let Engineering Own the Risk at Merge

🎙️ Coffee, Chaos and ProdSec, Ep 58

Your PR gate blocked the merge again. Or worse, the scan is still spinning and engineering wants to know why.

This week Cameron and Kurt make the case for informing over blocking. Cameron explains why every PR blocking rollout he's run caused more headache than value, and it was the ops game, not the findings. Engineering merges, engineering owns the risk.

Kurt takes it into the agentic SDLC, where scanners find and agents fix at machine speed, so a blocking gate just stalls the loop. They also vent about the chaos of the AI news cycle and call agent sandboxing what it is, system hardening.

If you work in Product Security, Application Security, DevSecOps, Security Architecture, or anywhere in Cybersecurity and you've ever unblocked a PR at 2 AM, this one's for you.

☕ New episodes every Wednesday.

Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.