r/zerotrust

Hey everyone. I'm an outsider here, but to embrace the spirit of this sub: I don't trust you, and I assume you don't trust me.

I don't trust my dependencies, I don't trust hallucination-prone LLMs, and I don't trust brittle ASTs (Abstract Syntax Trees) that break if the code doesn't perfectly compile.

The problem with modern static analysis is that we blindly trust what a repository claims to be. We take manifest files (like package.json or pom.xml) at face value. We trust that a file ending in .md, .csv, or .json is actually inert text.

That isn't Zero Trust. Taking a manifest at its word leaves your pipeline completely vulnerable to dependency confusion, typosquatting, or spoofed packages.

If we apply true Zero Trust to a codebase, file identities must be confirmed with different levels of evidence. If a file claims to be a plaintext document, we shouldn't just trust the extension. We need to physically verify its identity—looking at execution shebangs, magic bytes, or the presence of specific executable keywords—to prove it's not a disguised shell script or payload.

Manifests should be treated as mere "claims of intent." Their claims must be physically verified against the actual binaries downloaded to the disk before they are allowed to execute.

I wanted something fast enough to scan every PR in full, and to be able to scan every single codebase I download before I ever run it. Because ASTs and LLMs couldn't do this at scale, I built my own open-source zero-trust code scanner. It's on one of the code versioning sites, I'll trust you to figure out the rest.

We’re looking at a major refresh moment: remote access VPN that’s long in the tooth, a WAN that mixes MPLS and random tunnels, and security controls built around the assumption that datacenters are the center of the universe. Naturally, the “one SASE platform to replace VPN + SD‑WAN + a chunk of security” pitch is very appealing. One client for users, tunnels from sites into a nearby edge, and a unified policy model sounds like exactly what the diagrams in my head want.

What I don’t want is to jump into this and then realize in production that we still need the old VPN for oddball use cases or keep a standalone SD‑WAN setup for certain sites because the SASE platform can’t quite handle everything as promised. A long, messy coexistence phase where nothing really goes away is my nightmare scenario.

For anyone who went into a SASE project with the explicit goal of consolidating VPN and SD‑WAN, how close did you actually get? Were the remaining edge cases small enough that you still count it as “replacement,” or did it feel like you just shifted complexity into a new place?

Blunt experiences are more useful to me than high‑level “it’s great” takes. What would you do differently if you were starting your SASE platform rollout again now?