DevSecOps
In-depth guides and analysis on devsecops from the Safeguard engineering team.
100 articles
Your Deploy Kills Long-Running Jobs. Drain Instead.
SIGKILL after a ten second grace period destroys a twenty minute job and leaves its row marked RUNNING forever. Three drain strategies, the four ways they get undermined, and what to tell the user when one is lost anyway.
Where to Put the Security Gate So It Does Not Stop the Line
Most badly behaved security gates are correctly configured checks in the wrong position. The four places a check can run, what each can afford, and the rollout sequence that keeps a gate alive.
Push Protection Stops the Next Secret, Not the 500 Already in Your History
Blocking a credential at git push is genuinely good and solves exactly one half of the problem. The other half is every commit you have ever made, and deleting those commits is not the fix either.
npm CLI Login in CI: Tokens, npm-cli-login, and Safer Patterns
The npm-cli-login package automated interactive npm login for CI pipelines — a pattern that npm's 2025 authentication overhaul has made both broken and unnecessary. Here is what to use instead.
Eighteen Minutes: The Nx Console Extension Compromise and the IDE Blind Spot
A poisoned VS Code extension was live for eighteen minutes. In that window, auto-update pushed it into every developer environment with Nx Console installed — including a GitHub employee's device, leading to exfiltration of internal GitHub repositories. Your IDE extensions have no SBOM, no review, and a direct push channel to your engineers.
The AsyncAPI Hijack: When Trusted Publishing Becomes the Attack Path
On 14 July 2026 attackers used 37 pull requests against a pull_request_target workflow to steal the asyncapi-bot token, then let npm's OIDC trusted publisher automatically ship the malicious release. Four packages, 2.25 million weekly downloads, four hours live — and no code review was bypassed, because none was required.
The tj-actions/changed-files GitHub Action Supply Chain C...
CVE-2025-30066 exposed how a compromised tj-actions/changed-files GitHub Action leaked CI/CD secrets into build logs across 23,000+ repos. Timeline, impact, and fixes.
Jenkins Stapler Unauthenticated RCE Mass-Exploited for Cr...
CVE-2018-1000861 let attackers hit Jenkins Stapler unauthenticated, planting cryptomining malware on exposed CI/CD build servers across the internet.
Jenkins CLI Java Deserialization Remote Code Execution (C...
CVE-2017-1000353 let attackers gain unauthenticated RCE on Jenkins via CLI Java deserialization. Here's the impact, timeline, and how to remediate it.
Jenkins Remote Code Execution via Groovy Metaclass (CVE-2...
CVE-2016-0792 let attackers bypass Jenkins' deserialization blacklist using Groovy's metaclass to achieve unauthenticated remote code execution via the CLI.
Jenkins CLI Deserialization RCE via Commons-Collections G...
CVE-2015-8103: unauthenticated RCE in Jenkins CLI via a Commons-Collections deserialization gadget chain. Impact, timeline, and remediation.
Jenkins Script Security Sandbox Bypass Leading to RCE (CV...
CVE-2019-1003029 let attackers escape the Jenkins Script Security sandbox and execute arbitrary code via crafted Groovy pipeline scripts.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.