Securing tomorrow’s git forge, so we can reimagine everything else | Entire's Thomas Dohmke & Apiiro's Idan Plotnik

0:02Welcome back to Dev Interrupted, brought to you by Linear B. My guests today are Thomas Dohmke, the CEO of Entire, and Idan Plotnik, the co-founder and CEO of AppHero. Today we're talking about the new GitForge and what's required to make it successful. It's born from the ashes of how we shipped software before agents. Now writing code is cheap, and the cost is moved downstream into review queues, security backlogs, and pull requests that sit with nobody to chase them. And the messy, critical artifacts that agents make along the way? Well, they need a safe and secure home too. Entire is rebuilding the GitForge so your agent session's logs live alongside your code.

0:46And Apiro injects security contacts into the prompt before an agent writes a line. That's because the software factory of tomorrow relies on context being available just in time and just where it's needed. So learn how to ship like engineers in the future in this interview with Thomas and Idon. I'm really stoked because today on Dev Interrupted, we're talking about something that you can't deny, a transformation that's happening within the SDLC. And frankly, we talk about it constantly here on the show. I won't shut up about it. And if you're a frequent listener, then you know how much one of the things I opine about is the modern Git forge and the way that software is shipped and secured and understood and just the way that our software is consumed.

1:31And honestly, building something faster and safer are two goals that you can't compromise in today's market. And, you know, we've given quite a bit of attention to the mechanisms and mindsets that allow teams to change into this new way of working around both shipping and a Git forge, but then also having hardened real-time defenses as you build software. So needless today, I'm stoked for today's chat because joining us today are two titans of the industry on exactly these topics. Yes, we have a dev-interrupted science fiction double feature in store for you today. In one corner, we have Thomas Domke, the CEO of Entire, the GitForge of the future, which I've brought up a number of times on our show here.

2:18As the former CEO of GitHub, Domkey has a unique vantage on where this technology needs to go to meet the challenges of modern agentic development as a team sport. And joining him is Idan Plotnik, the CEO and co-founder of Apiro. And Idan's team is at the forefront of agentic AppSec, having recently shipped their own Guardian agent alongside a full software supply chain control center to enforce proactive cybersecurity for dev teams and their agents. So Thomas and Idan, welcome to Dev Interrupted. Hey, thanks for having us. Thank you very much. What an opening. And I would just say that there is no such thing as DLC anymore.

3:02It's ADLC, Agentic Development Lifecycle. Everything is agentic across, I think, any company in the world. Absolutely. And then we're going to be talking about how you change that S into an A and why every other acronym that we're working with these days is getting changed and morphed by all of this technology. And I want to start by, you know, maybe throwing this first question at you, Thomas, about some of the writings that you've had about the technology in the industry and how it's moving from engineering as a craft to a more assembly line model. And I'm wondering, you know, where do you think the industry sits right now in this transformation in time?

3:41I think it's still very early days and what it feels like forever ago that SharedGP launched and we started playing with GPT-3 and then GPT-4. I believe we're still very early in this transformation and we're all trying to figure it out quite literally by prompting agents, seeing them run. Sometimes they're getting overconfident and let it run for hours or even days on end. And then it's Monday and we're scratching our heads of what it actually produced and how much token got wasted. So I think it's early days, especially in software development and coding, the world has changed dramatically in multiple phases.

4:24We went from auto-completion in 2021 to chat in 2023. And then clearly 2025 was the year of agents with Cloud Code and Codex and Kersen, of course, Copilot Agent. and now we're in the middle of 2026 and we have all these agents writing all the code and now we're asking ourselves the question, how do we review all this? Or do we even review all this? How do we ship this with confidence? And maybe we need to slow down a little bit here and there as well. Yeah, I think slowing down and evaluating and understanding the code that we're shipping is a challenge that we're all grappling with. We have this sudden increase in throughput.

5:00Everyone's battling these new bottlenecks, especially around review. There's even bottlenecks around ideation, like the idea of the backlog evaporating. There's so many interesting phenomenon happening for teams. And Thomas, you noticed that you noted that we're pretty early in this transformation. But at the same time, you know, you're talking about an environment where agents are shipping code four times faster, but having been recorded as shipping 10 times the amount of vulnerabilities. So we're talking not only about an increased throughput in the code and the supposed impact that we're having for the downstream consumers, but also on the surface area and on the threats.

5:38And now we're even further abstracted from finding them. So where do teams tip the balance between productivity and risk? What do you see work? Yeah, so first, I don't think that we can ever stop the train or it's already gone, okay? So we cannot slow down anything, at least in the Fortune 500 companies that we serve. I would call it the perfect storm. The perfect storm has, on one hand, every company adopted the coding agents and developers doesn't write, review, test, or deploy the code. The agents are doing it. On the other hand, we have another storm, which is called the Mythos storm, where all of our customers, regardless, I literally spent three days on the road meeting customers.

6:30They all scanned their code bases with Mythos or Cyber Model from OpenAI while they're doing black box testing. And then what happened? You are bombarded with more vulnerabilities that you didn't know about. And then everything collapsed. Like the CISO and the CIO knows or the aha moment happens when they say, hey, my AppSec team, we're not growing the AppSec team. We're not bringing more people. But now I have 10x more vulnerabilities from Mythos, from scanning the code, from scanning, running black box testing. What do I do? And the last thing that I would say, and I will give the credit to JP Morgan because JP Morgan just released a document called Patchmageddon and proved in the data that the number of zero-day exploits that they discovered is much higher than the ability to fix them.

7:35And you don't even have a fix. So you have a zero day. You know that the attacker has this zero day, but you don't have a fix because the open source community didn't fix it fast enough. So I think we are in a real chaos. OK, so and we need both the side of reviewing the code, but also making sure that the code now it's not human. We need to train the coding agents to write secure, but also compliant code on every prop. And this is how we help our customers. Yeah. And you basically have said that the boat has flipped over here, right? The ability for us to catch up on those problems, on those vulnerabilities has escaped us at this point.

8:20It's reached a terminal kind of velocity. So how do we protect against this new environment that now encases all of the work that we do? And you're calling out that a lot of that involves shifting practices left, looking further left in terms of understanding how we provide context, how we secure, and then also having the right policies in place that act as guardrails for these agents in this environment. So they make real-time decisions, right? And what do you think about that frontier? Like, we all talk about shifting left and security is always moving left. Everything's always moving left. Now there's something even further left and it's the agent, right?

8:58And things need to shift into that agent. Yeah, I think Thomas actually invented the concept back then in GitHub. She left where he put all the scanners and guard. The thing here is that you need context. And unfortunately, context has like it's a double-edged sword. On one hand, it's too generic. And on the other hand, without the context, you cannot actually stop developers. And then you have friction between security and development teams. And this is what we're solving to the industry. We're saying we develop the patented technology that understand the software architecture for every change, and we generate risk intelligence on top of the software graph.

9:41And then we're able to guide the coding agent, no matter which coding agent you use, okay, anyone, based on the organizational specific context of understanding the software architecture and the policies and the risk on top of that. And then we have hooks. We are using hooks like everyone. Hooks are now our standard. Pre-prompt hooks, pre-commit hooks. Hooks on my hooks. All of your hooks. But the secret source is the context. What do you bring into these hooks? Because it can be the same problem five years ago where we tried to stop developers at the pull request, but then we stopped every pull request because we had no context to understand what is a risk to the business and what's not.

10:34So we use the same data fabric that we built for the last six years. And we inject seamlessly, enrich the prompt with the context that you need. And this now in Fortune 500 companies proved 81 % prevention of vulnerabilities and compliance violations. And the pre-committal, we do autofix. So our coding agent talks to your coding agent and auto-fix it before it goes to the new edge of source control manager, which is entire. So you get into entire or other solutions, clean and compliant code in an agentic way. Yes, exactly. And it all has to be housed somewhere. I'm great that you're talking about entire because it's really what I want to shift my attention to in my next question as well, because we're talking about context being the answer.

11:36So, you know, we have the king of context here, Thomas, to really fill us in on what that even looks like for the tooling and where that stuff has to live. And one of the things is like you described, you, Don, is understanding like the exact fingerprint of the organization and all of its software, getting that fingerprint. fingerprint. That requires a lot of work, a lot of tooling, but then also having it just in time, putting it in the agent's hand when it's needed at the right level of context. Because if you just have a fire hose and point the fire hose at everything, it's not useful. But ultimately, all of that data has to house somewhere, has to get aggregated.

12:12It has to get, it has to live. And there are so many ingredients that go into good context. So much of them around the agent sessions themselves. So Thomas, what do you think about the things that we should be storing and keeping as artifacts over time? And what in our system right now is so insufficient that's causing this runaway escaping problem of being able to keep up with even security threats? What do you see? You both already mentioned shift left, which I don't, I didn't invent, but I certainly practice it more and more. I think the term also comes from analysts and it's all about, right, let's you detect the security vulnerabilities before they reach your production system and lead to data leakage or you have to do a press conference and explain how you lost millions or sometimes hundreds of millions of customer records.

13:03With AI agents, we basically went all the way to the left. If you want to go further left, then you have to sit in my brain because now I'm using my hands and my mouth, my voice, my language to feed all the ideas in my agent. So there isn't really further left. There isn't a step where I have to convert my ideas into something abstract like code or a diagram anymore. They can just type and it starts appearing in front of me. And I think the mind-blowing examples are the one-shot ones where you can just say, you know, build me a game or build me a quick web page or something, something really complex, even training a model.

13:42That's the transition that has happened and where we are now. And that means that we're actually producing at work these session logs, the interaction between me and my agent or agents, right? Like I have multiple, some of them are writing code, some are reviewing legal docs, you know, some of them are summarizing my daily podcasts to me or my blogs. And of course, a lot of them then take all that work and review it and give me insights from a security perspective, from a deployment perspective and so on. And one of our thesis at Entire is that, okay, so if that's the work product, if that's the thing of writing every day, similar to documents and Slack conversations and so on, then we should also store those logs.

14:25And they shouldn't just sit on my computer in some tilde.claw.codexcaps directory. They should be sitting together with the code in the repository. And so that's the first feature that we announced earlier this year in February. with our open source CLI, you can automatically store your agent logs in the Git repository together with your code. And so code, you know, is the what or the how, if you will, and the session logs are the why. And it reflects, you know, my ideas, some called intent, you know, I think most developers never heard of that word outside all intents on iPhone and whatnot. From a technical perspective, they didn't think about their day as my intent today.

15:06It's like my ideas, my workload, my bug checks request and all that. All the tool calls, the model reasoning, as much as it's available, some of the model providers are instructing that these chain of thought steps as they consider them intellectual property. And of course, the response and the commit into the repository, all that is stored together in the code. And then you can do fun things with those. You can resume a session. You can hand over from one agent to another. Some of them have outages or you just want to move from your Mac Studio to your MacBook on the couch or on a plane or the other way around.

15:43Actually, you have to close your laptop because the TSA is reminding you that there's not the time to chipe on your keyboard and you'll want to hand over to a computer that runs in your office. All the way to using that information as intelligence, semantic layer graphs, whatever you call the thing, that either the agent can use or the human can use. And we know some funny examples of startup founders extracting all the most fun prompts and the most fun agent responses or the shittiest agent responses. And they're presenting them in their tout hall meeting as kind of like the joke of the week or joke of the month, right?

16:21There's a lot of learning from that, both from an entertainment perspective, but really from a, okay, so I know what I'm doing, but maybe Idan or Andrew or Stefan have a better way of prompting Claude for adversarial code review or to not have it repeat the same mistakes over and over again. So you need long memory. You need to be able to learn and the agent needs to be able to learn because the ultimate goal from my perspective is now that we can have these agents run as long as we need them to. And more often than not, that means now hours or nights and not just three seconds. And I've actually won running here on my other Mac.

17:05Not on this one because I'm conscious of the task manager destroying the CPU load. Mine's on the computer in the back, but let's go. And I have a little portrait-sized display that an agent found for me because I wanted one that is exactly the same size as my studio display so they are aligned on the top of the bottom, otherwise it irritates me. You're speaking my language. I got one of those too. Okay, great. We're on the same page. By the way, guys, you know that you can run the coding agents in the cloud. So I'm running that so they will not kill my machine. Precisely, that's how my viewports work.

17:40I have it running on a Mac in my office. A, it serves as a heater in the winter. It's a 2019 Mac Pro. And B, I hate the latency on typing in the cloud. But anyway, it doesn't matter. But my point is, I want that agent not to finish while we are recording this podcast. because if we do that, then, well, I mean, Idan and I both talk a lot, so I can just reiterate for Idan to answer something and then I can tell you quickly the response. But my point is, you want to have the agent similar to a team member and certainly a startup leaders. We know that feeling. We want team members to have autonomy, agency, and creativity until the point when we realize it went too far in a direction that I don't agree with or it spent too much money that I also don't agree with for both of those.

18:29And you spend, you know, millions of tokens on the model, self-optimizing something that plays no role to our business, right? And so how do we make these loops longer? That is, I think, the real challenge and why I think, yeah, the boat has tripped over. We are living in a, I think, to some degree, crazy world and a massive code that are being produced. At the same time, we haven't figured it out at all. And we are still so early in the journey. And if you come back here in two or three years, maybe even just in one year, the way we're working will be very different. Yeah, absolutely. And I just want to complete what Thomas said on two points because I see this on a day-by-day discussions with CISOs and CIOs.

19:14They are saying exactly what Thomas is saying. We are now, we gave these coding agents 24-7 tasks and now we see them reasoning on top of the code bases again and again. Now you have a problem where you can multiply the coding agent by the number of changes, by the number of repos, and then every agent changes something else in the repo that the other agent needs to know about. And this is exactly what Thomas is saying. If this literally they are spending so much money on things that they can solve with an entire or with a peer on the security side, where we are now giving the context when you do autofix or prevent, you don't need to reasoning again and again and again.

20:10And when we compared a task of autofix of a very complex vulnerability on a large monorepo, One query costs$6.1, where in a period with the data fabric, the same task costs$0.2. And this is a huge cost saving to the customers. The second thing that I want to touch on, and I agree with the intent point of view, but in the large enterprises, what they did, because as you know, everything is regulated and they need guardrails and yada, yada. So they actually using a Piro to scan the JIRA ticket or the GitHub issue that a product manager actually wrote and run a threat model on them before they copy and paste it or give the agent a way or access to the intent to start the task.

21:09Okay, so we can proactively or continuously run on every JIRA ticket or GitHub issue, run a threat model, give the output of the threat model, which are countermeasures to the coding agent, so they can run a more secure and compliant task in the background. Yeah, there's a really interesting kind of paradox happening here where you need to have everything so you can slice it down to exactly what you need. But you can't give everything everything. And you have these situations where like things are so expensive, right? And if you just like were to work on a mono repo type of level, or if you wouldn't actually look at the specific slices of what you need to do, you get this cognitive burden between all these coordinating sub agents because you divide them by role playing and like instead of cognitive locality, right?

22:03Instead of an agent that owns end-to-end some mental model that it can keep in its head and reliably work on and deliver, especially for long-running, folks have a tendency to split that up into seams to where things are moving between lots of agents. You get onboardings and off-boardings and loss of context and all of this compression is lossy. And in order to really fight this, one, you need a place where it all goes so you can understand what's moving and get the shape of it. You need to close the loop because, you know, like Thomas, I love how you called it out, like the idea of, you know, having loops that run on the organization and all of this data look back at sessions and find learnings and elevate new things.

22:44And they become like shareable stuff across the company as well. And that's actually really exciting for me because that's a macro version of like I have a loop like that that runs on my agents with their transcripts. transcripts. And I get like a recap like that at the end of a week and it helps me catch stuff they didn't catch. I see the instant value of that happening on an organizational level. In order for that to happen, you have to just have all of that context. You have to be able to pivot and study it. And then consumers and experts in their domain like Apiro can come in, right? And what's this slice of data?

23:18What makes the thing most secure? How can I coordinate all of this cognitive locality in the safest and least expensive way and everything that you said and for every change yeah this is for every yeah every change and at the same time it's like we see the rate of commits i see my github you know commit history thing like i see what's happening and everyone else is on that same page i'm not special i open my laptop on monday and cloud coats down for me, just like it is for everyone else. And so it's like, it's so like this velocity also brings me to my next point, which is I would love to get y 'all's vantage on in terms of how developers and product managers have to evolve for the skills they need to work with this new context.

24:06Cause I don't know about y 'all, but I find myself constantly in a position of explaining this context management and slicing and dicing and making it just in time and understanding the value of how to compact that information into like a layer that is durable for you and the agent. There's so many ways to crack that egg, but folks need to be thinking about it. So how do you, you create this, you know, an entire, you create this world where literally entirely everything lives, the transcripts and the delivery and everything in between. And, but just because that's there doesn't mean people know how to work with it or they know how to put good stuff in it or pull good insights out of it.

24:43So where do you think about teaching and getting the team to think in this loop-like way on top of all of this data? We mentioned earlier when we started the call, we believe we're already in this journey and we're going to reinvent the lifecycle, the way we're working. And you mentioned different roles and companies and how do PMs evolve, designers, marketing folks, security analysts. I think they're all going to be centered around code as the one thing that we all share, that all our agents produce, right? And if you look at Cloud or ChatGPT work, Cloud Co-Work and ChatGPT work, they are effectively coding agents with a little bit of a layer on top of it to work on your Word files or your Gmail or whatever this have you.

25:32And developers figured that out a little bit earlier than everybody else. They just use their coding agent because there's access to tools and APIs and all that to do a lot of the things that are outside of coding. And obviously, that's also true for a marketing manager. And a marketing manager can produce landing pages and process spreadsheets. And so to some degree, they have become engineers. Same for product managers and designers. Today, you don't really want to PM write your Google Doc with a concept or write your Jira ticket or start planning and tracking, which was the first part of the software lifecycle.

26:12Like I was always planning and tracking and then you had to do daily standup to break your epics into user stories, into work items. I think that's just, you know, the long term, that's all going to be a waste of time. Because you're producing artifacts that then somebody else copy and pastes into a coding agent, then you could have just started with a coding agent to begin with. And if you actually, you know, look at open source projects more often than not. now when people report issues in open source projects, they ask Claude first to analyze their data issue together with the code base. It's where open source gained another superpower.

26:49Because it can reuse the code base together with your agent and whatever problem, error message, and so on that you see to analyze that problem and then give the person reporting the bug to much more context on what's happening without necessarily sharing your data. Or you can get a step further and have it create a pull request or a change request where you already made a modification to the code base. And I think we should leave behind, many developers have that certainly as everything needs to be perfect. We were so skeptical of self-driving cars because every time you talk with somebody about self-driving cars a few years ago, they were all like, but what if on the left turn something unexpected happens, right?

27:29And then it rains like crazy here in Seattle and then it can't do this. And like, yeah, but how often does it actually happen in your day-to-day. And so you're much better off if you're planning for the 90 % case. And that also means the 10 % that are the hardest part still requires engineers in the organization. And I don't think we will see organizations where a PM or PMN roles are driving the whole ship or whatever. But certainly we will see more organizations where everybody is the creator. Everybody can produce an artifact within the company that lives in the same space and ultimately results in code.

28:12And then if you believe in that future, then obviously now you have a very different software development cycle that you had before. One that is much more collapsed into loops, multiple of these loops, and then some are short running and some are long running. And we have to figure out how we get value out of the long running loops. and basically decide at the beginning of the loop, how long should it run, what are my evals, at what point do I want to enter up? Because what we're seeing in 2026 is that our confidence level, our excitement level goes really high if something works well. And I get excited and it's like, okay, now I can keep you running and so much text and output is produced that especially when you have multiple terminals open or multiple threads in the Codex app that you very quickly lose all the context and you're not able to catch up.

29:10And if you're working on three or four projects at the same time, it's even worse. And so we also got to accept that we don't have that knowledge anymore of how every single line of code worked. But if you're honest, that was also never the case. We were just pretending on the ever-growing code basis. I'm sure Idan cannot in earnest on a Friday afternoon do a code review that ships to production tonight and confirm I found all the bugs. And so I think that's the road we have to think about and what engineering looks like. This is like spot on. And I want to take exactly what Thomas said to the security world.