devsecops
Safeguard articles tagged "devsecops" — guides, analysis, and best practices for software supply chain and application security.
868 articles
8 tips for securing your CI/CD pipeline
Real incidents like tj-actions and xz-utils show how CI/CD pipelines get compromised. Eight concrete, actionable tips to lock yours down.
AI Security Code Review for Pull Requests
How AI code review security works in pull requests, where Endor Labs stops short, and what closes the gap between diff review and real supply chain risk.
Building a secure CI/CD pipeline with GitHub Actions
The tj-actions breach exposed secrets in 23,000 repos. Here's how pwn requests, unpinned tags, and self-hosted runners put your CI/CD at risk.
Boto3 Security: Using the AWS SDK for Python Safely
Boto3 is the AWS SDK for Python, and how you configure its credentials, sessions, and version pinning decides how much of your AWS account you are putting at risk.
Exploring vulnerabilities in GitHub Actions workflows
From the tj-actions/changed-files hijack to PyTorch's self-hosted runner breach, real incidents show how GitHub Actions workflows keep getting exploited.
Securing self-hosted GitHub Actions runners
Self-hosted GitHub Actions runners trade GitHub's ephemeral isolation for persistent infrastructure access — here's how real incidents like CVE-2025-30066 exploited that gap.
How to Install the Snyk CLI (npm, Homebrew, and Standalone Binary)
Step-by-step ways to install the Snyk CLI on macOS, Linux, and Windows using npm, Homebrew, Scoop, or a standalone binary, plus how to authenticate and use it in CI.
Package Firewall: Blocking Malicious Dependencies at Inst...
Malicious npm and PyPI packages are published daily. See why a package firewall that blocks at install time stops attacks that post-hoc scanners catch too late.
Secrets management: tools and best practices
Secrets leak because of workflow gaps, not carelessness. Here's how vaults, scanners, and rotation policies actually stop credential exposure.
Finding and fixing exposed hardcoded secrets in GitHub projects
Hardcoded secrets leak into GitHub every day and get exploited within minutes. Here's how to find, fix, and prevent exposed credentials at scale.
Docker Rebuild Strategies: Cache and Layers Done Right
Docker rebuild speed and security both come down to how you order layers and invalidate cache — get it wrong and you either wait ten minutes per build or ship stale, unpatched images.
DevOps Performance Metrics That Also Measure Security
The DevOps performance metrics worth tracking are the four DORA metrics plus a handful of security signals that reveal whether speed is coming at the cost of risk.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.