Retrospective: 2 Years of DevSecOps at Stripe – Reducing Vulnerabilities by 70%

Two years ago, Stripe’s security team was drowning: 1,200 open vulnerability tickets, 42% of production deployments blocked by manual security reviews, and a mean time to remediate (MTTR) for critical CVEs of 14 days. Today, that’s 360 open tickets, 6% deployment block rate, and 4.2-day MTTR — a 70% reduction in net vulnerabilities across all Stripe codebases, with zero production security incidents tied to unpatched dependencies since Q3 2023. 📡 Hacker News Top Stories Right Now AI uncovers 38