The trade press covers the projects with logos, with venture funding, and with conference booths. The press does not cover the projects that the engineering team actually depends on, the projects that run in the background of every modern stack, the projects whose maintainers are unpaid, understaffed, and burning out. This is a list of the projects that the press does not cover but the engineering team cannot live without.
Cuelang: data validation that does not lie to you
Cuelang is a data validation language out of Google that does for configuration and data what TypeScript does for JavaScript. The premise is that you describe the shape of the data once, in a language that is both human readable and machine executable, and the tool chain gives you validation, code generation, and the kind of type safety that JSON Schema has been promising for a decade and not delivering.
The reason it is on this list stands as the boring reason. Every engineering team that has built a serious platform has built, at some point, a configuration validation layer that is buggy, incomplete, and forgotten about. Cuelang replaces that homegrown layer with a real tool that has a real type system, a real package manager, and a real community. If you are building infrastructure that takes structured input from a lot of sources, look at Cuelang before you build your own.
Litestream: SQLite replication that just works
Litestream is a tool that streams SQLite write ahead log files to S3 (or any S3 compatible storage) in real time, giving you point in time recovery for SQLite databases without standing up a database server. The tool is one binary, the configuration is one file, and the operational cost becomes the S3 storage bill.
The reason it is on this list stands as the boring reason. A lot of modern applications do not need a database server. They need a small, fast, embedded database that is going to live on the same host as the application, and the operational burden of running Postgres for a single tenant workload is more than the workload is worth. Litestream makes the SQLite only architecture a real option for the first time, with the backups handled in a way that does not require a database administrator to be on call.
Trivy: the security scanner that ships in the container
Trivy is a vulnerability scanner for containers, filesystems, and git repositories. It finds CVEs in the OS packages, in the application dependencies, and in the IaC definitions. It runs in CI in seconds. It runs in the Kubernetes admission controller. It is one of the few security tools that has become a default in the platform without anyone making it a default.
The reason it is on this list sits as the boring reason. Every engineering team needs a security scanner, and most of the commercial scanners cost money, are slow, and produce findings that the team does not trust. Trivy is free, fast, and produces findings that the team can act on. The Aqua Security team that maintains it has done a better job of building a community than most of the well funded security startups, and the result is a tool that the engineering team actually uses.
n8n: the workflow automation that does not lock you in
n8n is a workflow automation tool in the same category as Zapier, Make, and Workato. It is open source, self hostable, and has a node based editor that is more flexible than the consumer tools. The community has built hundreds of integrations, the documentation is solid, and the licensing is fair.
The reason it is on this list amounts to the boring reason. The consumer workflow tools charge per task, and the per task pricing gets expensive fast. The enterprise workflow tools charge per seat, and the seat pricing is worse. n8n lets you run the workflow engine on your own infrastructure, with your own credentials, and the only limit is what the host can handle. If you are running more than a handful of automations, the math favours self hosting n8n over paying Zapier, and the open source licensing means the team can read the code.
Sigstore: signing for the software supply chain
Sigstore is a project out of the Linux Foundation that provides signing and verification for the software supply chain. The tool chain lets you sign your container images, your binaries, and your releases, and lets the consumers verify that the artifacts have not been tampered with. The signing keys are stored in a transparency log, so the verification does not require trusting a single certificate authority.
The reason it is on this list runs as the boring reason. Software supply chain attacks are the dominant breach vector of 2024 and 2025, and the only real defence is signing the artifacts and verifying the signatures. Sigstore serves as the tooling that makes this practical, and the integration with the major build systems and the major container registries is mature enough to ship.
Why this list matters
None of these projects are going to make the front page of the trade press. None of them are going to be the keynote at the major conference. All of them are doing the work that the trade press does not cover, the work that the engineering team depends on, and the work that the maintainers are doing without the funding or the attention that the work deserves.
If your team depends on any of these projects (and your team probably depends on at least two of them), the right response is to fund them, to contribute to them, and to make sure that the maintainers are not the single point of failure that the supply chain risk framework warns about. The dependency is real. The funding should be real too.
The bottom line
The patterns the post covers have been showing up in production for long enough that the patterns have names, the failures, the mitigations, the gaps. The work the security team and the engineering team and the operations team are quietly doing today sits as the work that decides whether the practice the post names sits as a tool the team uses or a liability the team is paying for.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
