An independent software company in Vancouver.
We build tools for the points in a software lifecycle where a quiet failure becomes an incident, and we run them ourselves before we ask anyone else to.
Delivery has outrun the practices meant to keep it safe.
Teams adopting AI assistants ship more change, and ship it faster. More of that change is written by something that does not carry the context a reviewer has, and it reaches the same pipeline, the same registry, and the same production systems as everything else.
The practices that hold under that pressure are not new. Reviewed changes, a pipeline that gates rather than warns, control over what enters a build, and monitoring of what is running were the goal long before AI. Most teams never finished adopting them, because each one is a project of its own.
That is what we build, and it is how we work. We also self-assess against our six-domain AI DevSecOps maturity framework, and the Trust Centre says how to request the results.
Read the Trust Centre →How a change reaches production.
This site ships under the same rules as everything else we run.
Reviewed changes on a protected branch.
Every change to this site ships through a reviewed merge request against a protected main branch. A change merges only after review and a passing pipeline.
A pipeline that gates, not warns.
Every change runs linting, formatting, type checking, locale parity, a shellcheck of the deploy script, and a full production build. A merge completes only when all of them pass.
Our builds install through our own registry.
Every package this site installs in CI comes through the private registry we run, and Terraform providers come through the same mirror. If that registry is unreachable the build fails rather than falling back to the public one.
Releases are a deliberate step.
A green pipeline publishes nothing. Releasing the built site to production is a manual step someone takes once the pipeline has passed.
Our public status page at status.dependably.ca runs on our own monitoring tool, and our other repositories add a lockfile supply chain check, a spec alignment check, and secret scanning.
Where this maps onto frameworks a reviewer knows.
Our tools are engineered in line with OWASP application security guidance and SLSA supply chain principles, and we assess our own build pipeline against NIST SSDF (SP 800-218).
Where to check any of this.
The source, the licence, and the disclosure process are public.
What we host runs the code we publish.
The hosted edition runs the same engine as the self-hosted Community Edition, with the same policies and the same audit stream. The source published on GitHub is that engine.
The Community Edition is open source.
The Community Edition is licensed under Apache-2.0 and developed in the open on GitHub. The full source is readable and runnable without an account.
The Security Policy is public.
How to report a vulnerability, and what happens after a report, are documented in our public Security Policy at dependably.ca/security.