About the Author

Steve Poole leads software supply chain security work and created the REFLEX Framework.

Developer Advocate at HeroDevs, IBM Champion, Oracle ACE, Java Champion, Developer Security Champion, DevOps Lead.

A thoroughly seasoned engineer, leader and strategist, from operating systems to JVMs to ChatGPT.

Open source committer and contributor: Apache, Eclipse, OpenJDK. Member: OpenSSF, OWASP.

Mad Scientist and London Java Community Director.

A regular speaker at international conferences on technical and software engineering topics. Ex IBM, ex Red Hat, ex Sonatype.

Why REFLEX

This website is a collection of my thoughts and experiences on supply chain security, turned into dip-in education.

The goal is to help developers grok security and supply chain security in a way that's developer-focused, without the security or compliance buzzwords.

The framework has six stages: Reconnaissance, Evaluate, Fortify, Limit, Expose and Exercise. Together they take you from thinking like an attacker to practising your response, as the REFLEX overview explains.

Much of what's here is just a different take on good software engineering practice.

Links

Greybeards rule!