Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Dmitry E. Protsenko
Analyze Docker & Kubernetes files with Qodana
Hi! In this article, I’ll cover the interesting tool Qodana and how you could use it in CI/CD processes to scan your Docker and Kubernetes files with my Cloud Security plugin for JetBrains IDEs. Table of contents What is Qodana? Running Qodana in the IDE At the end What is Qodana? The Qodana is JetBrains’s static code analysis and code quality platform, built on the same inspection engine as JetBrains IDEs. It brings the smart code inspections from the IDE directly into your CI/CD processes.
Spring AI RAG example: index source code with PgVector
This Spring AI RAG example builds a source-code index with a Spring AI vector store backed by PgVector. It deduplicates files, splits them into embedding-sized chunks, and returns grounded answers with file citations taken from retrieval metadata. Think of it as a local Context7-style index for the library sources your project actually uses, with indexing exposed over MCP. A model trained last year does not know the API you upgraded to last week.
Spring Data JPA Transactions and Queries
The last but not least part of my series of articles on Spring Data JPA guide, employing best practices to help you keep the code base clean and avoid common mistakes. This guide was initially written based on observations from a huge legacy project, and to promote good practices, I collected all the problems, systematized them, and shared them with my former colleagues. The guide is updated and completely rewritten to utilize the latest features of Spring Data JPA.
Java and Kotlin news: JDK 28 gets structured concurrency and AOT code
A Spring Security upgrade quietly turns DPoP off in your Java resource server, and JDK 28 makes structured concurrency final. This digest covers 5 to 19 October 2026. Java Structured concurrency runs related subtasks in different threads as one unit. If one fails, the others are cancelled, and the parent can’t return while a child still runs. After seven preview rounds, StructuredTaskScope is final in JDK 28.
Spring Data JPA Best Practices: Repositories Design Guide
In this series of articles, I'm sharing my view on refactoring a large legacy codebase that employed many poor practices. To address these issues and develop better Spring Data JPA repositories, I wrote this guide to promote good practices in developing among my former colleagues. The guide is updated and completely rewritten to utilize the latest features of Spring Data JPA. Some of the examples may seem obvious, but they're not. It's only from your experienced perspective.
Spring Data JPA Best Practices: Entity Design Guide
You can enjoy the original version of this article on my website, protsenko.dev. This series of articles was written as part of my review of a large legacy code base that employed many poor practices. To address these issues, I created this guide to promote Spring Data JPA Best Practices in designing entities among my former colleagues. It's a time to clean the dust from the guide, update it, and publish it for a broader audience.
Kubernetes Security: Best Practices to Protect Your Cluster
You can enjoy the original version of this article on my website, protsenko.dev. Hi! In this article, I’m sharing 12 collected Kubernetes security best practices for making your cluster secure by writing secure deployments/services, etc. This article is based on my experience creating the Kubernetes Security IDEA plugin and all of the practices covered by the plugin. If this project or aticle has been helpful to you, please consider giving it a ⭐ on GitHub to help others discover it.
Using SBOMs to detect possible Dependency Confusion
Software supply chains have become a focal point for attackers, as modern applications rely heavily on third-party and open-source dependencies. Organizations are adopting Software Bill of Materials (SBOM) documents to gain visibility into their software components. In this article, we explore SBOMs, why the CycloneDX format is recommended (and how it compares to SPDX), and how an SBOM can be leveraged to detect and prevent dependency confusion in your projects.
Using SBOMs to detect possible Dependency Confusion
Software supply chains have become a focal point for attackers, as modern applications rely heavily on third-party and open-source dependencies. Organizations are adopting Software Bill of Materials (SBOM) documents to gain visibility into their software components. In this article, we explore SBOMs, why the CycloneDX format is recommended (and how it compares to SPDX), and how an SBOM can be leveraged to detect and prevent dependency confusion in your projects.
Revival Hijacking: How Deleted PyPI Packages Become Threats
This article is inspired by the article from 2024 and raises again concerns about the safety of downloading packages from public repositories without additional controls. The pypi.org allows packages to be removed by author and package name, making them publicly available for registration by anyone. By registering formerly popular packages, attackers could gain many downloads of malicious libraries. This technique is called revival hijacking.
Dev Diary #2: Cloud Security plugin for JetBrains IDE
Almost a year passed before I began developing the plugin to improve the security of Infrastructure as Code files. Many rules were implemented, especially for Docker and Dockerfiles, and many lessons were learned. This week, I found new energy to begin delivering the next milestone in the plugin’s lifecycle. I started implementing Kubernetes rules to align with the NSA Kubernetes Hardening Guide. I have always postponed implementing rules to analyze YAML files because it was struggling boring.
Revival Hijacking: How Deleted PyPI Packages Become Threats
You can find the original version of this article on my website, protsenko.dev. Hi guys, recently I continued researching malicious dependencies and dependency confusion. This article is inspired by the article from 2024 and raises again concerns about the safety of downloading packages from public repositories without additional controls. The pypi.org allows packages to be removed by author and package name, making them publicly available for registration by anyone.
Cloud Security plugin for JetBrains IDEs | Dev Diary #2
Almost a year passed before I began developing the plugin to improve the security of Infrastructure as Code files. Many rules were implemented, especially for Docker and Dockerfiles, and many lessons were learned. This week, I found new energy to begin delivering the next milestone in the plugin’s lifecycle. I started implementing Kubernetes rules to align with the NSA Kubernetes Hardening Guide. I have always postponed implementing rules to analyze YAML files because it was boring.
AI-assisted hacking with JetBrains Junie: Subdomain enumeration. Lessons I Learned.
This information is provided for educational purposes only. You can find the original version of this article on my website, protsenko.dev. You can enjoy it there completely free, without ads or signup requirements. Over the last weeks, I’ve been taking the Certified Ethical Hacker course, and there is a lot of practice that can be automated. The course provided information on how to automate reconnaissance with AI by utilizing sgpt. My way was different — I tried to automate it with JetBrains Junie.
Dependency Confusion: Critical Security Risks of Using Internal Dependencies
You can find the original version of this article on my website, protsenko.dev. You can enjoy it there completely free, without ads or signup requirements. This article dives into Dependency Confusion — how it works, how to spot vulnerable packages, and how to reduce risk. It’s one of my favorite supply chain threats because it opens direct attack paths. Dependency confusion attacks the supply chain to deliver malicious code into the development environment.
Dev Diary #1 - Google Agent Development Kit: Lessons I Learned
This diary-tutorial hybrid tracks my first months with Google’s Agent Development Kit (ADK) — pure experience, insight sharing, and nothing else. The ADK is Google’s open-source framework for designing, chaining, and shipping autonomous AI agents. If you are unfamiliar with this framework, read my beginner guide to build AI agents quickly. Lessons I learned You don’t need many AI agents, one for each task. An agent can call as many tools as it needs.
This diary-tutorial hybrid tracks my first months with Google’s Agent Development Kit (ADK) — pure experience, insight sharing, and nothing else. The ADK is Google’s open-source framework for designing, chaining, and shipping autonomous AI agents. If you are unfamiliar with this framework, read my beginner guide to build AI agents quickly. Lessons I learned You don’t need many AI agents, one for each task. An agent can call as many tools as it needs.
Building AI Agents to Prioritize CVEs - A Google ADK Guide
In this story, we will create our first AI agents using Agent Development Kit. AI agents will be integrated with Google OSV, MITRE, KEV, and a bit of Google search. AI agents will enrich data about given vulnerabilities with public data from different sources to help prioritize (triage) problems. Will these AI agents help prioritize vulnerabilities?
Malicious Packages in NPM and PyPI: How Typosquatting Threatens Developers
What I discovered after generating 227K mimic package names — and how you can protect yourself Malicious packages lurk in NPM and PyPI — especially in NPM. If you’ve built front-end apps, you’ve likely used npm, pnpm, or yarn. You’ve probably tweaked package.json or run npm add something. These tools streamline dependency management. Each install pulls code from npmjs.com and runs scripts locally — sometimes with deep system access. Uploading to these registries requires little effort.
You Don’t Need a Pet Project to Be a Good Dev: How I Beat FOMO
Do you ever feel like you’re falling behind in your tech career? Everyone builds pet projects, speaks at conferences, and posts on LinkedIn. Meanwhile, you’re just trying to finish your sprint without burning out. That’s FOMO — and here’s how I’ve started to deal with it. What is FOMO, and how could CBT help FOMO, or the fear of missing out, is the anxiety that one might be excluded from rewarding experiences others enjoy, a feeling often intensified by social media.
You Don’t Need a Side Project to Be a Great Developer
I open LinkedIn. People launch side apps, speak at meet‑ups, drop fresh repos. I just close another sprint, tired. The stomach twist? That’s FOMO. FOMO is the fear of missing out. A story your brain whispers: “They ship. You stall.” The feeling is real. The story is not. I treat FOMO like bad code. Enter Cognitive Behavioral Therapy. CBT is a mental debugger. Find the bug. Refactor the thought. Example bugs: • All‑or‑Nothing: “No side project?
AI Will Take My Job, But Not Today
Recently, I noticed new feelings and thoughts about AI in Software Development. I felt upset about recent news such as “Programming no longer needed in the nearest time” and “AI will replace programmers”. I took a lot of time to develop a career as a software developer, and now AI will replace me. We live in a fantastic world where AI can solve many technical problems, and this technology makes our lives better. I use it almost every day, but not for production-ready programming.
How I made Docker linter for IntelliJ IDEA (and other JetBrains IDE)
I’ve had an idea to create a powerful plugin for making Infrastructure as Code (IaC) files more secure and reliable. IaC files define infrastructure through code, such as Dockerfiles or Kubernetes configurations. I developed this idea because I’m passionate about Security, DevOps, and Development. Another reason was to create something I could promote, gaining experience managing and promoting an open-source project.
Personal Guide to Becoming a Good Developer
Learning programming can be complicated. In this article, I share my tips on becoming a good developer. My way could be different than yours. I started my way into school, and some advice could work if you have a lot of time or have a well-paid job to not worry about money. Programming is easy if you love it There is no secret pill on learning something new and complex. You should love what you do.
Top 7 Dockerfile Security Tips You Should Know
I built a tool to uncover security flaws in Dockerfiles. While refining it, I collected the most common misconfigurations—and practical ways to avoid them. Don’t use default or latest images. When you skip the version tag — Docker pulls the latest image. The latest versions of images are unpredictable and lead to issues with reproducibility and security.
Boosting Developer Focus with ADHD-Based Strategies
Software Development requires extensive attention. I’ve worked successfully as a developer for the past eight years and want to share my tips on improving my focus. I’m not diagnosed with ADHD, but studies about ADHD could teach everyone how to improve focus and attention. This is not my definitive guide because writing more without your support is hard. Please share your stories in the comments about improving your focus or dealing with ADHD, and follow me. It motivates me to write more.
How I made Docker linter for IntelliJ IDEA (and other JetBrains IDE)
Dmitry Protsenko · Follow 8 min read · -- TL;DR In this article, I’m sharing my experience creating an IDE plugin as a pet project. I developed the plugin to help find security and maintainability issues in Docker files and perfectly integrated it into JetBrains IDEs. I’ve had an idea to create a powerful plugin for making Infrastructure as Code (IaC) files more secure and reliable. IaC files define infrastructure through code, such as Dockerfiles or Kubernetes configurations.
In Vivo Needle-Based Electromechanical Reshaping of Pinnae: New Zealand White Rabbit Model
Importance Electromechanical reshaping (EMR) is a low-cost, needle-based, and simple means to shape cartilage tissue without the use of scalpels, sutures, or heat that can potentially be used in an outpatient setting to perform otoplasty. Objectives To demonstrate that EMR can alter the shape of intact pinnae in an in vivo animal model and to show that the amount of shape change and the limited cell injury are proportional to the dosimetry.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Dmitry E.
Contact Dmitry E., search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack