Modern software is built on trust. We trust open-source packages we did not write, CI/CD pipelines we rarely inspect, container images we download in seconds, cloud services managed by others, and increasingly, AI-assisted code that promises to accelerate development. Every commit, dependency, build, and deployment is an act of trust—but trust without verification has become one of the greatest risks in modern software engineering. Attackers understand this. Rather than attacking applications directly, they increasingly target the software supply chain, exploiting the tools, processes, and dependencies that development teams rely on every day. A single exposed secret, vulnerable dependency, compromised build pipeline, or malicious package can have consequences that extend far beyond a single application. This highly interactive workshop takes participants on the journey of modern software development, following a project from a developer's workstation to production. Working in teams, participants will investigate a simulated software supply chain compromise involving a deliberately vulnerable application. Along the way, they will uncover exposed secrets, insecure dependencies, misconfigured CI/CD pipelines, vulnerable container images, and other weaknesses that attackers routinely exploit. Rather than simply identifying problems, participants will progressively strengthen the software delivery pipeline by applying practical DevSecOps principles and implementing security controls at each stage of the Software Development Life Cycle (SDLC). Through guided hands-on exercises, they will integrate automated security checks, improve dependency management, secure secrets, strengthen build pipelines, and explore how security can become an enabler of faster, more resilient software delivery rather than a barrier to innovation. The workshop will also examine the growing role of AI-assisted software development, helping participants understand where AI can accelerate secure software delivery, where it introduces new risks, and why human oversight remains essential when building trustworthy systems. By the end of the session, participants will have gained more than an understanding of DevSecOps—they will leave with a practical framework for evaluating trust throughout the software delivery lifecycle, hands- on experience using widely adopted open-source security tools, and a repeatable checklist they can immediately apply to strengthen the security of their own projects and development teams.