Tag

CI/CD security

27 articles

Latest in CI/CD security

Secrets Sprawl and Rotation: A Practical Vault Management Playbook

In 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year jump the company has recorded in five years of publ…

Oct 8, 20263 min

All CI/CD security Articles

Showing 1–24 of 27

Sep25

Blogs

DevSecOps Teams as Partners in Secure Software Delivery

DevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable.

3 min

Sep21

Blogs

GitHub Separates Who Writes Code From Who Runs Your CI

GitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security.

3 min

Sep18

Blogs

Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface

CI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern…

3 min

Sep14

Blogs

More JFrog Artifactory Bugs Are Under Attack, and All Three Have Patches

Attackers are actively exploiting three JFrog Artifactory flaws, exposing how slow patching can turn artifact repositories into software supply chain attack paths.

3 min

Sep14

Blogs

GitLab’s Critical Patch Closes a Path Traversal Flaw Attackers Are Already Probing

GitLab patches two critical flaws, including a CVSS 10.0 unauthenticated file-read vulnerability, putting self-managed instances under urgent pressure to upgrade.

3 min

Aug26

AI Can Generate Your Infrastructure. Can Your CI/CD Pipeline Trust It?

AI-generated infrastructure code is exposing a growing security gap, pushing platform teams to add stronger automated gates, provenance tracking and human review before Terraform,…

3 min

Aug21

Blogs

Why Cryptographic Inventory Is the First Step Toward Quantum Readiness

Post-quantum readiness starts with visibility. DevOps teams need a continuous cryptographic inventory to map algorithms, keys, certificates, libraries, infrastructure and third-par…

3 min

Aug13

The Agent Proposes, the Pipeline Disposes: Controls for AI-Authored Change

When agents write code and open pull requests faster than humans can read them, ‘the diff looked fine’ stops being a control. The durable controls live outside the agent’s reasonin…

3 min

Jul27

Blogs

GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks

GitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads.

3 min

Jul23

Blogs

The Trust Graph: Why Infrastructure Diagrams No Longer Describe Modern Systems

Traditional architecture diagrams miss the identity relationships that now drive breaches and outages. Platform teams need trust graphs that map who and what can act across modern…

3 min

Jul21

Blogs

Zero Trust Starts at the Code: Building Secure Systems with PKI and DevOps Automation

When a certificate expires, it can take down a production system, and teams usually only find out after something goes wrong. These issues are hard to catch because they rarely tri…

3 min

Jul13

Blogs

Why Developer Workstations Have Become a Critical Part of the Software Supply Chain

For years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest tha…

3 min

Jul06

Novee Uncovers Cordyceps: The Latest Threat to CI/CD Pipelines

A newly discovered supply chain security flaw is once again putting a spotlight on inherent weaknesses in CI/CD pipelines and the growing interest among cyberthreat actors to explo…

3 min

Jun12

Blogs

Why Endpoint Protection Matters More than Ever in CI/CD Environments

CI/CD environments depend on far more than repositories and deployment infrastructure. Developer endpoints hold sensitive data: cloud credentials, SSH keys, deployment permissions,…

3 min

Jun12

Blogs

Shift Left to the Developer’s Machine: Building Local Git Security Gates

Shift left to the developer’s machine. The principle is what matters: Stop secrets before they ship. The tooling is a means to that end.

3 min

Jun05

Agentic DevSecOps: AI Security Co-Pilots for Your CI/CD Pipeline

The emergence of AI has brought endless possibilities and innovative opportunities in today’s ever-changing, fast-paced technology landscape. AI is helping development teams produc…

3 min

May15

Blogs

Widespread Mini Shai-Hulud Campaign Is a Matter of Trust

The latest series of attacks using the notorious Shai-Hulud worm puts into sharp focus the threats facing software developers and their CI/CD pipelines, an issue that has been rais…

3 min

May14

Blogs

Your CI/CD Pipeline Has Non-Human Identities You Forgot About

A deployment starts failing late on a Friday evening. The initial assumption is that something changed in the application release. Teams start checking container images, Terraform…

3 min

May08

Blogs

AI-Generated Apps Without DevOps: A Security Disaster Waiting to Happen

A small internal tool was built over a weekend. An engineer used an AI coding assistant to generate most of the backend. A simple interface was added, a few API calls were wired to…

3 min

Jan29

Blogs

AWS CodeBuild Webhook Misconfiguration Exposed Admin Access Risk

AWS fixed webhook filter misconfigurations in CodeBuild that could have allowed unauthorized repository access. No customer impact or malicious code found.

3 min

Oct03

Blogs

Build vs. Buy: What it Really Takes to Harden Your Software Supply Chain

When it comes to securing the software supply chain, engineering teams often assume that the choice between building their own hardened images or buying a solution is straightforwa…

3 min

Oct01

Blogs

Worms in the Supply Chain: Shai-Hulud and the Next DevOps Reckoning

DevOps was supposed to make software delivery faster, safer and more reliable. For the most part, it has. But every so often, something nasty crawls out of the shadows and reminds…

3 min

Sep22

Blogs

The DevSecOps Career Path: What No One Tells You About Getting Started

DevOps teams across organizations are suddenly finding themselves responsible for security with no roadmap. One day, teams are focused on deployment velocity and infrastructure aut…

3 min