ci-cd
Safeguard articles tagged "ci-cd" — guides, analysis, and best practices for software supply chain and application security.
205 articles
DAST Automated Testing: How It Works and Why It Belongs in CI
A DAST automated test probes your running application for vulnerabilities the way an attacker would, on every build. Here is how it works and the benefits of wiring it into CI.
Code Scanning Tools: How to Choose and Use One That Works
A code scanning tool automatically inspects your source and dependencies for vulnerabilities. Here is how the main types differ and how to wire one into CI without drowning in noise.
Working With the Semgrep API: Pulling Findings and Automating Scans
The Semgrep API lets you list deployments, pull findings, and manage projects and tokens programmatically. Here is how authentication works and how to use it well.
Snyk and GitHub Actions: How to Wire Up CI Scanning
How to set up Snyk in GitHub Actions the right way — the official actions, storing your token, uploading SARIF to code scanning, and gating pull requests.
What Is a DevOps Pipeline? Stages, Tools, and Security Gates
A DevOps pipeline is the automated path code takes from commit to production. Here are the stages every pipeline shares, the tools teams actually use, and where security gates belong.
Securing GitHub Actions Reusable Workflows at Scale
Reusable workflows centralize CI logic — and centralize compromise. Pinning, secrets scoping, org policy, and the review process that keeps one bad merge from owning 400 repos.
Snyk Status: How to Check if Snyk Is Down and What to Do About It
The Snyk status page at status.snyk.io tells you whether the platform, its scanners, and integrations are healthy. Here is how to read it and how to keep a Snyk outage from breaking your pipeline.
Code Scanning Software: How to Pick the Right Tool
Code scanning software analyzes your source and dependencies for security flaws automatically. Here is how the categories differ and how to choose.
How Snyk's .snyk file structures ignore rules with expiry...
How Snyk's .snyk file encodes vulnerability ignore rules using reason and expiry date fields, and what happens in CI once an exception lapses.
How the --policy-path option centralizes ignore rules acr...
A technical look at how Snyk's --policy-path flag lets teams share one .snyk ignore file across repos instead of duplicating exceptions everywhere.
DevOps Maturity Models, Explained
What a devops maturity model actually measures, why devops mttr alone is a weak proxy for maturity, and how teams can measure whether devops delivery value is improving.
ZAP Security Testing: Using OWASP ZAP in Your Pipeline
ZAP security testing works best as a pipeline stage, not a desktop tool. Docker scan modes, authentication, alert filters, and the CI wiring that makes findings stick.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.