Scott Hebert
Scott Hebert is a Senior Principal Software Engineer at Red Hat with over 15 years of experience in cloud-native infrastructure, container security, and DevSecOps. He served as an architect on Konflux, Red Hat's open source software supply chain security platform, and currently works on Red Hat Hardened Images and Project Hummingbird — a next-generation initiative to deliver ultra-minimalist, distroless container images that dramatically reduce CVE exposure in production environments.
Scott is passionate about making supply chain security practical and accessible for development teams, and brings a builder's perspective to the intersection of AI infrastructure and software integrity.
Session
Container images ship with hundreds of packages you didn't choose, each one a potential vulnerability. When AI-assisted security research began surfacing real CVEs at an unprecedented rate, we had to rethink how our supply chain worked from the ground up.
This talk is the story of building a fully autonomous container supply chain that monitors upstream releases, detects vulnerabilities before CVEs are published, generates package updates, builds across architectures, runs tests, and ships patched images — processing roughly 1,000 merge requests per week without a human clicking approve. I'll share the architecture decisions that worked, the ones that didn't, and the surprising non-technical problems we had to solve along the way.
You'll leave with practical patterns you can apply to your own pipelines: RPM lockfiles for deterministic builds, reproducible builds that let anyone verify your output, policy-driven automation boundaries that separate "the machine handles this" from "a human needs to look," and the guardrails that make autonomous merging safe rather than reckless.