A proof of concept for delivering an API credential through Declarative Device Management and letting a signed broker use it, so MDM scripts can trigger an authenticated request without ever holding the secret. Includes the signing, install-behavior, and asset-hosting problems that cost me most of two days.
How a single committed secret inspired a complete rethinking of Jamf Pro script management, and the open-source framework that came out of it. Presented at JNUC 2026, Kansas City, MO.
A one-day security review changed this self-service admin tool from a timer and user-writable state into a root-owned record with multiple revocation backstops.
What I put in a half-day workshop on versioned, secret-scanned, linted macOS script repos: Gitleaks, ShellCheck, semantic versioning, CI, and what to do when a secret is already in your history.
A security-first architecture for JIT admin and MDM automation that keeps directory API secrets off managed Macs.
Security Called: How I Turned a Scripting Disaster into a GitOps Pipeline, presented at the Mac Admins Conference at Penn State.
One Committed Secret and the Scaffolding Tool That Changed My Workflow, presented at the Concord Software Developers meetup, Concord, NC.
As AI tools proliferate faster than security reviews can keep up, IT teams need fleet-wide visibility into what’s actually running. Three Jamf Extension Attributes for detecting LiteLLM, compromised npm packages, and AI gateway tools across your managed endpoints.
Sentinel turns CVE severity into macOS update urgency: a Jamf orchestrator builds phased deployment plans, and a notifier explains the deadline to users.