AI is writing code faster than any human team ever could. The uncomfortable question nobody asked for: who — or what — is reviewing the supply chain it drags along with it? Three pillars — JFrog, Chainguard, and GitOps — have emerged as the answer to that question. Here's why they matter, and why they matter together.
More posts on modern DevSecOps and software delivery in the AI era are on the way.
The problem: velocity without custody
Modern applications are assembled far more than they are written. A typical cloud-native service pulls in hundreds of open-source dependencies, a handful of base container images, language runtimes, and increasingly, AI models and agent plugins. Each one is a trust decision — and most of them were made implicitly, years ago, by someone who has since left the company.
Attackers noticed. Software supply chain attacks are now counted among the top critical security threats where adversaries hold the advantage. JFrog's 2026 State of the Union report on supply chain security found 177,000 new malicious packages detected, with malicious npm packages surging 451% year-over-year. And the target has moved: attackers are going after AI models, agentic developer tools, and the workflows themselves — not just finished applications.
AI coding assistants made this dramatically worse. When an agent generates code, it also generates dependencies — imports, packages, Dockerfiles — at machine speed. A developer might review the logic; almost nobody reviews the provenance of every transitive dependency the agent chose. The result is a software factory running at unprecedented velocity with a supply chain nobody fully inventoried.
This is the context in which JFrog, Chainguard, and GitOps stopped being "nice to have" tooling and became infrastructure. They attack the same problem from three directions: Chainguard ensures what enters your factory is clean to begin with; JFrog governs what flows through it; GitOps guarantees what reaches production is exactly what was reviewed and approved.
JFrog: the system of record for everything you ship
JFrog's core insight is simple: you cannot secure what you cannot see, and you cannot see artifacts that are scattered across a dozen registries, file shares, and "temporary" S3 buckets. The JFrog Software Supply Chain Platform — built around Artifactory — acts as the single source of truth for every binary artifact in the organization: containers, Helm charts, npm/Maven/PyPI packages, and now AI models.
What makes it a DevSecOps pillar rather than just a fancy file server:
- Curation at the gate. JFrog Curation blocks malicious or policy-violating packages before developers can pull them — scanning at the moment of request, not after the code is already built.
- Xray: continuous, binary-level scanning. Every artifact is scanned for vulnerabilities, license issues, and exposed secrets, and re-scanned as new threat intelligence arrives — so a CVE disclosed on Tuesday is flagged in artifacts built last month.
- Signed release bundles and SBOMs. Immutable, cryptographically signed bundles with full software bills of materials give you a verifiable chain of custody from build to production — the receipts auditors and regulators increasingly demand.
- AI asset governance. At swampUP 2026, JFrog unveiled AgentSecOps capabilities: scanning AI models and agent plugins, ensuring AI coding agents only consume trusted artifacts, and governing the agentic workflows that now write production code. This directly addresses the governance gap where most organizations still source AI models from untrusted repositories.
In June 2026, JFrog was named a Leader in the first-ever Gartner Magic Quadrant for Software Supply Chain Security — recognition that the platform approach (security embedded in the delivery flow, not bolted on beside it) is winning.
Chainguard: start clean instead of triaging dirty
If JFrog is the customs agency, Chainguard is the decision to stop importing contraband in the first place. Chainguard's breakthrough idea: most container vulnerabilities don't come from your code — they come from the base image. A typical Debian or Alpine base ships hundreds of packages your application never uses, each one a potential CVE. Chainguard builds minimal, hardened images (on their Wolfi Linux distribution) containing only what's needed, rebuilt daily, with zero known CVEs.
Why this is a strategic shift, not just a product choice:
- Eliminate, don't triage. The industry's default posture has been "scan everything, then argue about which CVEs matter." Chainguard inverts it: start from zero and keep it there. One widely cited ranking of 2026 supply chain tools put Chainguard at #1 for exactly this "eliminate-first" strategy.
- Provenance by default. Every image ships signed, with an SBOM and SLSA provenance — cryptographic proof of where it came from and how it was built. No extra pipeline steps, no afterthought.
- Continuous rebuilds with an SLA. Images are rebuilt daily, and Chainguard commits contractually to remediating known exploited vulnerabilities within 24 hours of an upstream fix. Your base image is never more than a day stale.
- Chainguard Libraries. The same philosophy extended to language dependencies — hardened, vetted open-source libraries as a safe source for the packages your applications consume.
The scanner finds nothing because there's nothing to find. Teams that migrate to Chainguard bases routinely watch vulnerability backlogs collapse — not because they fixed hundreds of CVEs, but because the CVEs were never in the image to begin with.
GitOps: what reaches production is exactly what was approved
JFrog and Chainguard secure the supply side — the artifacts. GitOps secures the delivery side: the path from artifact to running system. The principle is deceptively simple: the desired state of your infrastructure and applications lives declaratively in Git, and an automated agent (Argo CD, Flux, and their successors) continuously reconciles the live environment against it.
Why this is a DevSecOps pillar, not just a deployment convenience:
- No drift, no surprises. If someone — or some compromised process — changes production out of band, the GitOps agent detects the drift and reverts it. The running system can never silently diverge from the reviewed, approved definition.
- Every change is a reviewed commit. Deployments become pull requests: diffable, attributable, and subject to the same code review, policy checks, and approvals as application code. In the AI era, where agents can generate infrastructure changes too, this is the control plane that keeps machine-speed changes human-governed.
- Rollback is a revert. When an incident hits, recovery is
git revert— fast, deterministic, and auditable, instead of a frantic manual scramble. - Policy as code, enforced at the gate. Admission policies — signed images only, SBOMs required, no privileged containers — are declared in Git and enforced automatically before anything reaches the cluster. The policies JFrog and Chainguard make possible are the policies GitOps makes mandatory.
Git is the audit trail the auditor actually wants. "Show me exactly what was running in production on March 3rd, who approved it, and what changed since" — with GitOps, that's a git log, not a forensic investigation.
Why they matter together
JFrog, Chainguard, and GitOps are complementary, and the combination is where modern DevSecOps gets its teeth:
- Chainguard minimizes what enters the pipeline — clean base images, hardened libraries, signed provenance from the start.
- JFrog governs everything that flows through it — curation, continuous scanning, signed release bundles, and distribution with a full audit trail.
- GitOps guarantees what reaches production matches what was approved — declarative desired state in Git, continuous reconciliation, automatic drift correction, and policy enforcement at deploy time.
Together they implement a genuine zero-trust software supply chain: never trust an artifact by default, always verify its origin, contents, and integrity — at ingestion, at build, and at deploy. That maps directly onto the zero-trust security architecture principles we build around at TwoCoins.ca: identity and provenance for every component, policy enforcement at every boundary, and no implicit trust anywhere in the chain.
Why the AI era makes this urgent
Three forces are converging:
1. AI writes dependencies, not just code. Coding agents choose packages, base images, and model artifacts autonomously — and increasingly generate infrastructure changes too. Without curation at the registry (JFrog), clean starting inputs (Chainguard), and Git-reviewed deployments (GitOps), every agent prompt is a potential supply chain incident.
2. AI models are supply chain artifacts. A model file is a binary blob from the internet that you execute with broad permissions. It needs the same custody — scanning, signing, provenance — as any container image. JFrog's move to treat AI assets as first-class artifacts is the industry catching up to this reality.
3. Attackers use AI too. The "CVE blitz" — automated discovery and exploitation of vulnerabilities at machine speed — means the window between disclosure and exploitation keeps shrinking. Daily-rebuilt images and continuous re-scanning aren't paranoia; they're matching the adversary's tempo.
The bottom line
DevSecOps in the AI era isn't about adding more scanners to the pipeline. It's about restructuring the pipeline so that trust is produced at every stage rather than hoped for at the end. Chainguard gives you inputs that start clean and stay clean. JFrog gives you custody and governance over everything you build and ship. GitOps guarantees that what runs in production is exactly what was reviewed and approved — nothing more, nothing less. Adopt all three, and your software factory stops being the weakest link in your security posture — and starts being the proof of it.
More posts on modern DevSecOps in the AI era coming soon.
TwoCoins.ca helps organizations design secure software delivery platforms — from artifact strategy and supply chain hardening to zero-trust architecture. Start a conversation.