How to Secure a CI/CD Pipeline: A Prioritized Checklist
A prioritized, practical checklist for securing CI/CD pipelines: access control, secrets, runner isolation, dependency and action pinning, artifact signing and logging.
#software supply chain
Everything we have written about software supply chain.
What Is DevSecOps? Building Security Into the Pipeline
DevSecOps moves security checks into each stage of the pipeline. Here is what runs where, how to keep it fast, and a practical order to roll it out.
What Is a Software Supply Chain Attack? How Vendors Become Entry Points
How attackers turn trusted vendors, updates and open-source packages into entry points, with real examples and a practical vendor vetting checklist.