ci-cd
Safeguard articles tagged "ci-cd" — guides, analysis, and best practices for software supply chain and application security.
205 articles
Your DAST Scan Has Six Timeouts and No Deadline
Per-phase timeouts add up. Six phases capped at ten minutes each is a sixty-minute scan wearing a ten-minute label — and the phase that mattered gets whatever is left.
What Is a Build Artifact?
A build artifact is the packaged output your build process produces from source code. Here is why artifacts are a critical supply chain checkpoint and how to verify their provenance.
Every Supply Chain Attack of June and July 2026 Was After the Same Thing
Nine incidents in eight weeks: a PyPI worm, typosquatted payment SDKs, jscrambler, AsyncAPI, Hugging Face, Polymarket, Nx Console, Medtronic, AdaptHealth. Nine different vectors, one prize — credentials sitting in developer environments and build pipelines. If you fix one thing this quarter, fix that.
The AsyncAPI Hijack: When Trusted Publishing Becomes the Attack Path
On 14 July 2026 attackers used 37 pull requests against a pull_request_target workflow to steal the asyncapi-bot token, then let npm's OIDC trusted publisher automatically ship the malicious release. Four packages, 2.25 million weekly downloads, four hours live — and no code review was bypassed, because none was required.
Docker Security Scanning: How to Find Vulnerabilities in Your Images
Docker security scanning inspects your container images for known-vulnerable OS and application packages before they reach production. Here is how it works and how to wire it into your pipeline.
DevSecOps best practices for secure builds: an 8-point SDLC framework
Log4Shell (Dec 2021) and the XZ Utils backdoor (Mar 2024) exposed two different SDLC failure modes. An 8-point framework closes both.
Policy as Code: Enforcing Cloud Security Guardrails in CI/CD Instead of Manual Review
OPA reached CNCF Graduated status in January 2021 — yet most teams still catch misconfigured IAM roles by eyeballing a pull request.
Where Security Gates Belong in Your CI/CD Pipeline
23.8 million secrets leaked on public GitHub in 2024 alone. The fix isn't more scanners — it's putting the right gate at the right stage and tuning out the noise.
The ZAP Security Testing Tool: A Practical Guide
How the ZAP security testing tool works as a free DAST scanner: passive and active scanning, the spider and AJAX spider, and how to run it in CI without noise.
Scanning AI-Generated Code Before It Merges: Wiring Scanners into Coding Assistants with MCP
Research found ~40% of Copilot suggestions were vulnerable, and devs using AI assistants trusted their code more. MCP lets you scan before merge.
Reconstructing the tj-actions/changed-files compromise
CVE-2025-30066 hit CISA's KEV list within 3 days: 23,000+ repos ran a poisoned GitHub Action that dumped CI secrets straight into public build logs.
OIDC vs Static Credentials in CI/CD (2026 Guide)
Static secrets in CI are the credential most likely to be stolen — as the CircleCI breach proved. OIDC federation issues short-lived, per-run credentials with nothing to leak. Here is how to make the switch.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.