ci-cd
Safeguard articles tagged "ci-cd" — guides, analysis, and best practices for software supply chain and application security.
100 articles
npm-check-updates: A Safe Dependency Upgrade Workflow
npm check updates (ncu) shows you every dependency with a newer version than your ranges allow. The tool is simple; the workflow around it is what keeps upgrades from breaking prod.
DAST Vendors Compared: Picking a Dynamic Scanning Tool
Choosing among DAST vendors hinges on how well the scanner authenticates, crawls modern apps and APIs, and fits into CI without turning into a manual chore.
DAST Automated Testing: How It Works and Why It Belongs in CI
A DAST automated test probes your running application for vulnerabilities the way an attacker would, on every build. Here is how it works and the benefits of wiring it into CI.
Code Scanning Tools: How to Choose and Use One That Works
A code scanning tool automatically inspects your source and dependencies for vulnerabilities. Here is how the main types differ and how to wire one into CI without drowning in noise.
Working With the Semgrep API: Pulling Findings and Automating Scans
The Semgrep API lets you list deployments, pull findings, and manage projects and tokens programmatically. Here is how authentication works and how to use it well.
Snyk and GitHub Actions: How to Wire Up CI Scanning
How to set up Snyk in GitHub Actions the right way — the official actions, storing your token, uploading SARIF to code scanning, and gating pull requests.
What Is a DevOps Pipeline? Stages, Tools, and Security Gates
A DevOps pipeline is the automated path code takes from commit to production. Here are the stages every pipeline shares, the tools teams actually use, and where security gates belong.
Securing GitHub Actions Reusable Workflows at Scale
Reusable workflows centralize CI logic — and centralize compromise. Pinning, secrets scoping, org policy, and the review process that keeps one bad merge from owning 400 repos.
Snyk Status: How to Check if Snyk Is Down and What to Do About It
The Snyk status page at status.snyk.io tells you whether the platform, its scanners, and integrations are healthy. Here is how to read it and how to keep a Snyk outage from breaking your pipeline.
Code Scanning Software: How to Pick the Right Tool
Code scanning software analyzes your source and dependencies for security flaws automatically. Here is how the categories differ and how to choose.
How Snyk's .snyk file structures ignore rules with expiry...
How Snyk's .snyk file encodes vulnerability ignore rules using reason and expiry date fields, and what happens in CI once an exception lapses.
How the --policy-path option centralizes ignore rules acr...
A technical look at how Snyk's --policy-path flag lets teams share one .snyk ignore file across repos instead of duplicating exceptions everywhere.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.