Posts

LLM from Scratch - 1

To kick my very own LLM model that can be train and learned from simple dataset - i started off with a bare minimum model that allows me to learn really simple stuff like 1 + 1 = 2, 2 + 2 = 4.   So first we outline our vocabulary and size - how we are representing this information to the LLM model Vocabulary and token Then we tokenize those input for training and inference. This model only understands these vocab Special: <pad> , <start> , <eos> Operators: + , - , = Numbers: 1 , 2 , 3 , 4 Simple transformer with: Embedding Layer : Converts token IDs to 32-dim vectors and this is the layer where we handle our vocab      # Token embedding   self . embedding = nn . Embedding ( vocab_size , d_model , padding_idx = 0 ) Positional Encoding : Learnable position embeddings      # Positional encoding (learnable)   self . pos_embedding = nn . Embedding ( seq_len , d_model ) Transformer Encoder : 1 layer with 2 attentio...
Post a Comment
Read more

github dependabot configuration and simple demo

Image
Github dependabot scans your repository for dependencies that are outdated, vulnerable package, run tests automatically and can even auto-merge if it is safe to do so.  It is different from CodeQL or CQL where CQL would do security code scanning for coding and vulnearabilities.  How to enable dependabot?  Goto your repository -> Settings -> Advanced Security -> under the tab Dependabot and then turn it on. To enable your package malware alerts, you can click on the "Dependabot rules" and then you will see this layout here where you can enable it by clicking on the "pencil" button. When will you get the scan results?  You typically get the scan results minutes.  In my repo here, https://github.com/kepungnzai/dotnet-dependabot-test - we have old and vulnerable packages and then dependabot come back with a PR for me which looks something like this - which is amazing! 
Post a Comment
Read more

transitioning pipelines to a devsecops pipeline design

  Traditional DevOps focuses on speed and reliability but often treats security as an afterthought — vulnerabilities are caught too late in production. DevSecOps integrates security at every stage of the pipeline. Here are the critical additions: The "Shift Left" Principle Instead of finding security issues after deployment, DevSecOps catches them early : Pre-commit : Scan for secrets before code is pushed Build time : SAST analysis, dependency checks, container scanning Pre-deploy : Verify signatures, compliance gates, IaC security Runtime : Intrusion detection, vulnerability monitoring Post-deploy : DAST testing, regression checks # DevSecOps vs DevOps Pipelines in GitHub Actions ## Core Differences ### Traditional DevOps Pipeline - ** Focus ** : Speed and reliability - ** Security ** : Added at the end (security testing after deployment) - ** Approach ** : "Shift right" - security concerns are addressed late ### DevSecOps Pipeline - ** Focus ...
Post a Comment
Read more