Enterprise security playbook
The codebase visibility security framework
Principles for finding, understanding, and fixing risk at codebase scale, for engineering and security leaders operating across thousands of repositories.
The three pillars
- 1
Find every instance, everywhere
When a new CVE drops, can you list every place the affected package is used, including archived services, acquired codebases, and transitive dependencies, in one query instead of forty re-scans? A complete, queryable inventory of every repository you own is the foundation everything else depends on.
- 2
Understand what a finding actually touches
A scanner tells you a package is vulnerable and reachable. It doesn't tell you which services depend on it, who owns them, or whether this instance is exploitable in context. Tracing that blast radius, and cutting false positives without chasing them repo by repo, is what turns an alert into a decision.
- 3
Fix at the same scale you find and understand
Ticket-per-team, pull-request-per-repo remediation was tolerable at forty repos. At thousands, it stretches a single CVE fix into weeks with no central view of what remains. Push a coordinated fix everywhere at once, verify it centrally, and monitor so the pattern can't quietly reappear.
