Travis McPeak and the art of getting out of the way

The first attempt to make life easier for Netflix developers produced a rather awkward result: more work for the security team. Travis McPeak and his colleagues had offered a choice. Use an infrastructure template, or ask for help. Developers asked for help. The queue filled. A well-intentioned shortcut had become another place to stand in line.

McPeak’s response was to change the experience. He took responsibility for a Slack bot called s3_create. It asked practical questions about the storage a developer wanted, then supplied a properly configured bucket. The security expertise stayed inside the machinery. The person trying to ship software could get on with it.

That small episode contains much of his career. McPeak has worked on Python security tools, automated cloud permissions, led product security at Databricks, and co-founded Resourcely with Aladdin Almubayed. After Resourcely’s acquisition by Anysphere in 2025, he joined the work of securing AI-assisted development. The tools have changed considerably. His interest in removing unnecessary friction has proved rather durable.

The template nobody wanted

In McPeak’s account, Netflix had singled out storage and identity permissions as areas where security needed control. There were roughly 50 requests for new S3 buckets each month, alongside hundreds of identity and access requests. The team could see the bottleneck it had become.

The bot replaced an infrastructure lesson with a conversation: where should the bucket live, what should it be called, and who needed access? Other teams extended the approach to databases and networking. His practical lesson was to start with a small, consequential problem and remove work from the developer’s path.

There is a modest comedy in this. Experts often want everyone else to appreciate the intricacy of their subject. A successful self-service tool may require the opposite ambition. The customer wants a bucket. The expert must resist delivering a seminar about buckets, however excellent the slides.

Before the paved road, a Bandit

McPeak’s earlier career ran through Symantec, HPE, and IBM. His open-source work put him among engineers trying to make security checks usable beyond a single employer. Bandit, the Python security linter to which he was a core contributor, examined code for potential security problems. His work also included the OpenStack Security Project and the founding of the Cloud Foundry Security Team.

Those communities offered a different setting from the internal security department. Engineers from separate companies could work on shared defenses. In 2016, McPeak described an OpenStack security group whose projects included Bandit, security guidance, a developing review process, and API fuzzing. The work combined code, documentation, and the patient business of getting people to use both.

The public record has its less ceremonial moments, too. In a February 2016 development chat, McPeak was working on Bandit’s profile generator as the team approached version 1.0. There were fixes, documentation, and reviews to finish. Software history often looks like this at close range: a release getting nearer, somebody asking for another review, and a group moving the work along.

Teach the permissions to tidy themselves

At Netflix, another problem rewarded the same preference for automation. Applications accumulate access rights. Developers need enough permission to make their software run, but yesterday’s useful permission can become tomorrow’s unnecessary exposure. Asking a small security team to keep every application’s rights perfectly pruned creates an expanding clerical occupation.

Repokid used information about the permissions applications actually exercised to remove unused access. McPeak presented the approach at Enigma in January 2018 under the title “Least Privilege: Security Gain without Developer Pain.” His team was trying to make tighter access compatible with frequent software delivery.

The details mattered. Some applications used particular permissions only occasionally and needed exceptions. Changes needed ways to be detected and reversed when something broke. Automation required an escape route as well as a rulebook. The aim was a service developers could accept, with room to defer changes and recover from mistakes.

The project’s name carries the joke: Repokid repossesses permissions. The repository describes an AWS tool for distributed, high-velocity deployment. Its premise turns maintenance into a continuing process, rather than a ceremony performed once when an application is young and everyone still remembers why it exists.

“Our goal is for developers to view this as a service that the security team provides for them”

Travis McPeak, 2018

A founder’s bet on fewer chores

By April 2021, McPeak was explaining a new assignment at Databricks: leading a dedicated product security function within engineering. The agenda included vulnerability management, authentication and authorization, security reviews, infrastructure hardening, and a paved road for developers. He described the responsibility in terms of earning customers’ trust with their data.

It was a leadership role with a building brief. Hire security engineers and architects, establish foundations, and help engineering ship products with protection built in. The recurring phrase, “secure by default,” gave that long job description a short destination. Defaults could carry expertise into ordinary engineering decisions, including decisions made by people whose specialty lay elsewhere.

Resourcely brought the idea into a company. McPeak and Almubayed announced their venture in 2022, with McPeak as CEO and Almubayed as CTO. The seed round totaled $8 million, led by Andreessen Horowitz and Felicis. The founding proposition was direct: cloud services were powerful, configuration was demanding, and developers already had plenty to do.

The company’s introduction used the example of setting up a service with a friendly address and a TLS certificate. An apparently simple request could summon a collection of naming rules, cryptographic settings, and renewal duties. The founders wanted developers to benefit from established practices without repeatedly learning all the underlying specialties.

In 2024, McPeak laid out the cost of this burden: software engineers had inherited deployment, configuration, and security alongside writing applications. Resourcely’s Blueprints provided configurable templates; Guardrails enforced requirements. The system generated Terraform and worked through existing review processes. The intention was to make a sound configuration easier to obtain in the first place.

That distinction shaped the product. A template could guide a developer toward an approved arrangement. A policy could catch a change that strayed outside it and route an exception for approval. The work involved deciding which choices should remain flexible and which deserved a deliberate pause. It was an argument about where to spend human attention.

The people nearest the problem

McPeak carried more than technical ideas out of Netflix. In a 2023 founder conversation, he discussed the “Informed Captain” principle: the person closest to a problem should have authority to make the decision. He had adopted it at Resourcely. A company designed to remove engineering queues needed to consider its own decision queues, too.

He also discussed cooperation among security practitioners at companies including Facebook, Apple, and Google. Commercial competitors could share an interest in defense. It is a useful connection to his earlier open-source work: the boundaries of an employer do not neatly contain the problems its security team encounters.

His community work had a practical character. He led the Bay Area OWASP chapter from November 2016 to August 2021, describing a dozen volunteers organizing meetups, hands-on events, and conferences. Keeping that operation moving meant budgets, recruitment, and clearing obstacles for other people. The unglamorous verbs belong in the portrait.

There was room for other interests. His 2017 speaker biography listed snowboarding, travel, and good food and drink. By May 2025, he was sitting down with Netflix principal engineer Scott Behrens to discuss technical mastery versus people management. His public conversations allowed for careers that developed along different tracks.

The next colleague writes code at machine speed

Resourcely’s acquisition by Anysphere in July 2025 took McPeak into Cursor’s security work. By September, he was discussing how to build an application security program that fit the engineering workflow. The question now involved developers using AI systems that could produce code and take actions on their behalf.

In December’s Boring AppSec conversation, he explored AI’s usefulness for work such as threat modeling while stressing the need to understand generated code. Faster output did not relieve engineers of judgment. It moved the point where that judgment had to operate, toward the tools already helping people build.

His March 2026 account of Cursor’s security agents described four automations: Agentic Security Review, Vuln Hunter, Anybump, and Invariant Sentinel. They covered new changes, existing code, dependency updates, and drift from security requirements. The team introduced blocking reviews after first observing findings privately and gaining confidence in their quality.

That sequence is revealing. Before giving a system the power to interrupt engineering, the team wanted to know whether its interruptions were useful. A noisy tool could find plenty to discuss while creating another queue. McPeak’s concern with the experience of the person receiving the finding had survived the move into AI.

Permission to get on with it

In June 2026, McPeak and David Gomes described Auto-review, a contextual reviewer for agent actions. Repeated approval prompts could train people to click without reading. The system assessed actions before execution, considering the user’s request and the consequences. When it blocked a step, feedback could help the working agent choose a safer approach.

By October, McPeak was identified in security at SpaceXAI in an announcement about Endor Labs and Grok Build, formerly Cursor. His contribution emphasized separating vulnerabilities that could affect the application from findings that added noise. The names on the products had changed; the problem of directing attention remained familiar.

Across these jobs, the interesting unit of progress is often a chore that disappears: a permission trimmed, a configuration supplied, a patch prepared, a needless prompt avoided. McPeak’s career gives those small removals a substantial place in the story of building software. A developer gets something useful done, and the security team has helped make that ordinary.