s1ns3nz0 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026
diff --git a/docs/pages/ai-security/overview.mdx b/docs/pages/ai-security/overview.mdx
@@ -135,6 +135,8 @@ verify currency before using them in decisions.
 - [DevSecOps](/devsecops/overview): isolation, pipeline, and sandbox depth
 - [Secure Software Development](/secure-software-development/overview): when AI code lands in production paths
 - [Supply Chain](/supply-chain/overview): model, plugin, and MCP-style tool trust
+- [Developer Workstation Security](/supply-chain/developer-workstation-security): owns pre-execution screening and
+  allowlisting for plugins, MCP servers, agent rules, and model artifacts
 - [OpSec](/opsec/overview): operator and key-handling next to agent tools
 - [Awareness](/awareness/overview): human misuse and social engineering with AI assistants
 - [Incident Management](/incident-management/overview): response when agentic systems cause loss

diff --git a/docs/pages/config/contributors.json b/docs/pages/config/contributors.json
@@ -1,4 +1,17 @@
 {
+  "s1ns3nz0": {
+    "slug": "s1ns3nz0",
+    "name": "s1ns3nz0",
+    "avatar": "https://avatars.githubusercontent.com/s1ns3nz0",
+    "github": "https://github.com/s1ns3nz0",
+    "twitter": null,
+    "website": "https://miata.cloud",
+    "company": null,
+    "job_title": null,
+    "role": "contributor",
+    "description": null,
+    "badges": []
+  },
   "mattaereal": {
     "slug": "mattaereal",
     "name": "matta",

diff --git a/docs/pages/devsecops/developer-targeted-intrusions/handling-untrusted-code.mdx b/docs/pages/devsecops/developer-targeted-intrusions/handling-untrusted-code.mdx
@@ -161,6 +161,8 @@ proof that every other recipient avoided execution.
   repository-controlled input into code execution
 - [Developer machine confinement](/devsecops/isolation/developer-machine-sandboxing): practical confinement patterns
   for developer tools and AI coding agents
+- [Developer workstation security](/supply-chain/developer-workstation-security): the governance side of this
+  procedure, covering allowlists, MCP and package approval, and exception evidence
 - [Incident Management](/incident-management/overview): preparation, escalation, investigation, containment, and
   recovery guidance
 - [SEAL 911 War Room Guidelines](/incident-management/playbooks/seal-911-war-room-guidelines): emergency coordination

diff --git a/docs/pages/devsecops/developer-targeted-intrusions/overview.mdx b/docs/pages/devsecops/developer-targeted-intrusions/overview.mdx
@@ -128,6 +128,8 @@ before allowing the new revision onto a privileged workstation or into a trusted
 
 ## Further reading
 
+- [Developer workstation security](/supply-chain/developer-workstation-security): governing which tools, MCP servers,
+  dependencies, and model artifacts are approved before any of this reaches a workstation
 - [SEAL: VS Code Tasks Abuse](https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/):
   a developer-targeted campaign using workspace tasks
 - [Elastic Security Labs: Bit ByBit](https://www.elastic.co/security-labs/bit-bybit): analysis of malicious source,

diff --git a/docs/pages/devsecops/integrated-development-environments.mdx b/docs/pages/devsecops/integrated-development-environments.mdx
@@ -102,6 +102,8 @@ controls in place.
   external repositories
 - [Developer machine confinement](/devsecops/isolation/developer-machine-sandboxing): confining agent and IDE
   workloads on the laptop
+- [Developer workstation security](/supply-chain/developer-workstation-security): governing which extensions, MCP
+  servers, and dependencies are approved in the first place
 - [Repository hardening](/devsecops/repository-hardening): controls for the code the IDE pushes
 - [Security testing](/devsecops/security-testing): pipeline counterparts to IDE analysis
 - [Visual Studio Code Workspace Trust](https://code.visualstudio.com/docs/editing/workspaces/workspace-trust):

diff --git a/docs/pages/dprk-it-workers/techniques-tactics-and-procedures.mdx b/docs/pages/dprk-it-workers/techniques-tactics-and-procedures.mdx
@@ -322,6 +322,8 @@ are used as cover. Incorporate unpredictable, interactive requests that a pre-re
     recruiters](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/)
     and [Two Campaigns by North Korea Bad Actors target job
     hunters](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/).
+    [Developer Workstation Security](/supply-chain/developer-workstation-security) owns the pre-execution intake and
+    confinement controls for coding exercises and unfamiliar repositories used in campaigns like this.
     Your North Korean employee **may leverage the credibility granted by being employed at your company to conduct
     malware-related campaigns in the present and future.** This could significantly affect your brand.
 5. **A DPRK IT Worker will try to escalate their access if possible**, whether by adding new members (who will also

diff --git a/docs/pages/opsec/endpoint/overview.mdx b/docs/pages/opsec/endpoint/overview.mdx
@@ -49,6 +49,9 @@ Issue organization-managed hardware to your highest-risk roles. This provides fu
 
 **Target roles:** Developers with production access, leadership, treasury custodians, key signers, security leads.
 
+For developer roles, [Developer Workstation Security](/supply-chain/developer-workstation-security) owns the
+pre-execution screening boundary for repositories, IDE configuration, dependencies, and AI tooling on managed endpoints.
+
 ### Tier 2: Virtual Desktop Infrastructure (Privacy-First Scale)
 
 For global contractors where issuing hardware is impractical, VDI provides a secure cloud-hosted environment