Operations | Monitoring | ITSM | DevOps | Cloud

There's a risk window after a malicious package is published when nobody knows it's there. Scanners alone can't close that window.

Everyone keeps saying we don't need junior engineers anymore. This episode makes the case that's exactly wrong. Rob sits down with two CircleCI colleagues at opposite ends of the experience spectrum: Hanabel Mengistu, a new grad less than a year into her first engineering role, and Michael Webster, who has been writing software professionally since 2012. Together they explore what it actually feels like to enter the industry right now, when AI has reshuffled the deck for everyone.

Every dependency security program needs a way to handle packages that have a valid business reason to stay in use despite a CVE or license issue. Ideal exception processes give developers full context upfront, including safer alternatives, then route real requests to a security team that weighs the risk profile and logs who requested it, who approved it, and for how long. Get the friction wrong in either direction and the process fails: too much and developers route around it, too little and it becomes the default path.

We intentionally introduced a bug into our app to see what would happen. The agent used the CircleCI MCP Server to detect the failed pipeline, diagnose the issue from the build logs, implement a fix, and keep iterating until CI was green.

Open source is the backbone of most software. But should developers trust OSS? npm, PyPI, and Maven don't vet packages before publication, so "publicly available" doesn't automatically mean "safe to pull right now." A secure OSS posture is to trust the ecosystem but verify at ingestion: route packages and dependencies through a controlled layer that runs scanning, age checks, and malware detection before anything reaches a build.

Eighty percent of new developers on GitHub start using Copilot within their first week. How many really know what it's pulling in?

Code generation gets all the attention, but one of AI's biggest strengths might be helping non-engineers prototype ideas, explore solutions, and get work done that otherwise never would have happened.