ci-cd
Safeguard articles tagged "ci-cd" — guides, analysis, and best practices for software supply chain and application security.
100 articles
DevOps Maturity Models, Explained
What a devops maturity model actually measures, why devops mttr alone is a weak proxy for maturity, and how teams can measure whether devops delivery value is improving.
ZAP Security Testing: Using OWASP ZAP in Your Pipeline
ZAP security testing works best as a pipeline stage, not a desktop tool. Docker scan modes, authentication, alert filters, and the CI wiring that makes findings stick.
Python Syntax Checker: Catching Errors Before They Ship
A Python syntax checker validates that your code parses and follows the rules of the language before you run it. Here are the tools that do it and how they fit a secure pipeline.
How Can a DevOps Team Take Advantage of Artificial Intelligence?
A DevOps team takes advantage of artificial intelligence by using it where signal is buried in noise — triaging alerts, prioritizing vulnerabilities, and drafting fixes. Here is where it pays off and where it does not.
How Snyk CLI's --severity-threshold and --fail-on flags g...
How Snyk CLI severity-threshold and fail-on flags filter and gate vulnerability findings, plus exit codes and common CI/CD misconfigurations.
How the Snyk CLI's exit codes are structured for CI/CD fa...
A mechanical look at how the Snyk CLI's 0/1/2/3 exit codes work, how --severity-threshold and --fail-on change them, and how to branch on them correctly in CI/CD.
Unit Testing in Node.js: A Practical, Security-Aware Setup
A working guide to unit testing in Node.js with the built-in node:test runner — structure, mocking, coverage, and the security-relevant code paths most suites forget to cover.
Megalodon: 5,561 GitHub Repos Backdoored via Injected Actions Workflows (May 2026)
In a six-hour window on May 18, 2026, an automated campaign pushed malicious GitHub Actions workflows into 5,561 repositories using credentials harvested by infostealers. We break down the attack chain, the workflow_dispatch dormancy trick, and CI detection.
Mutable Tags Strike Again: actions-cool GitHub Action Tags Redirected to Imposter Commits (May 2026)
In May 2026, every tag on actions-cool/issues-helper and 15 tags on maintain-one-comment were quietly moved to point at imposter commits that stole CI/CD credentials from runner memory. A look at the mutable-tag attack class and how to defeat it.
DevOps Metrics Tools: What to Track and How to Measure It
DevOps metrics tools collect and visualize the delivery and reliability signals that tell you whether your engineering system is actually improving. Here is what to measure and with what.
Snyk Test CLI: How to Scan Projects from the Command Line
The snyk test CLI command scans your project's dependencies for known vulnerabilities right from the terminal. Here is how to run it, gate on severity, and wire it into CI without slowing everyone down.
lint-staged (npm): A Security Review and Safe Setup Guide
The lint-staged npm package runs linters and formatters only on your git-staged files, keeping commits clean and fast. Here is how to configure it safely and what its command-running design means for security.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.