ci-cd
Safeguard articles tagged "ci-cd" — guides, analysis, and best practices for software supply chain and application security.
205 articles
TanStack's Build Pipeline Got Hijacked and Still Signed Valid SLSA Provenance (May 2026)
On May 11, 2026, attackers chained a pull_request_target abuse, cache poisoning, and OIDC token theft to publish 84 malicious @tanstack npm versions from TanStack's own trusted pipeline. It is the first npm compromise to carry valid SLSA provenance.
How to Run a ZAP Scan: OWASP ZAP for Practical Web App Testing
A hands-on guide to running a ZAP scan against your own web app, from the passive baseline to a full active scan, and how to wire it into CI.
Git Branching Strategies With Security Gates
Trunk-based, GitHub Flow, or GitFlow — your branching model decides where security checks can actually block bad code. Here is how to wire gates into each.
Snyk Dependency Scanning: How It Works, Its Limits, and Alternatives
A fair look at Snyk dependency scanning: what it does well, how its test-based pricing works, where teams hit limits, and how to decide if it fits your workflow.
DAST Tools for DevSecOps Teams
The best DAST tools for DevSecOps teams run inside CI/CD rather than as a separate pre-launch step, and Gartner's own analysis of the DAST market backs that shift as the defining trend.
jest-junit: Secure CI Test Reporting for Jest
jest-junit turns Jest test results into JUnit XML that CI systems can read. Here is how to configure it and keep the reporting pipeline free of security surprises.
Cloud Security and DevOps Automation: Building Guardrails Into the Pipeline
How cloud security and DevOps automation fit together: shifting checks into CI/CD, policy as code, automated IaC and image scanning, and the pitfalls that make automation give false confidence.
DevSecOps SAST: How to Wire Static Analysis Into Your Pipeline
SAST in DevSecOps means catching code-level flaws before they merge, not after they ship. Here is how to integrate static analysis so developers actually use it.
Azure DevOps Pipeline Supply Chain Hardening 2026
A 2026 hardening guide for Azure DevOps Pipelines: service connections, workload identity federation, approval gates, agent isolation, and SLSA integration.
Static Code Scan: How SAST Finds Bugs Before They Ship
A static code scan analyzes source without running it, catching injection, secrets, and unsafe patterns early. Here is what it can and cannot see, and how to wire one into CI.
Security in Agile Development: A Practical Guide
Security in agile development works when it moves at sprint speed instead of blocking releases. Here is how to embed AppSec into backlogs, PRs, and pipelines without killing velocity.
What Is a DAST Solution? Choosing Dynamic Testing for Web Apps
A DAST solution tests your running application from the outside, the way an attacker would. Here is how dynamic testing works, what it catches, and how to pick one that fits your pipeline.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.