Security Guides
Who can read my GitLab CI job logs and artifacts?
GitLab's project-based pipeline visibility setting decides who sees job logs and artifacts. Clear it to limit public project logs to Reporters and above.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
GitLab instance, group or project runners: which for deploy jobs?
Use instance runners for similar general jobs and project runners for jobs that hold credentials, such as deploys. How GitLab's three runner scopes differ.
Oct 18, 20263 min read
Security Guides
What does GitLab IaC scanning check, and what are its limits?
GitLab IaC scanning uses KICS to check Terraform, Kubernetes, CloudFormation and more in CI. See supported formats, setup steps and known limits.
Oct 18, 20263 min read
Security Guides
GitLab CI include: project, remote or template, which is safer?
Prefer include:project over include:remote for shared GitLab CI config, point it at a fixed ref you control, and review shared file changes like code.
Oct 18, 20263 min read
Security Guides
GitLab application security scanners: which one answers which question?
A map of GitLab's built-in scanners: SAST, secrets, dependency, container, IaC and DAST, with what each looks at and the tier notes we could confirm.
Oct 18, 20264 min read
Security Guides
Why .gitignore does not hide a secret you already committed
Adding a file to .gitignore only stops future tracking. A secret already committed stays in history until you rotate it and, if needed, rewrite the repo.
Oct 18, 20263 min read
Security Guides
GitHub vigilant mode: flagging unsigned commits as Unverified
Vigilant mode marks every commit and tag under your name with a verification status, so an unsigned commit that claims to be you shows as Unverified.
Oct 18, 20263 min read
Security Guides
GITHUB_TOKEN, GitHub App token or PAT: which should a workflow use?
Default to the built-in GITHUB_TOKEN with minimum permissions. Use a GitHub App for other repositories. Use a PAT only when nothing else works.
Oct 18, 20263 min read
Security Guides
GitHub Actions secrets: repository, environment or organization?
Repository secrets suit one repo, organization secrets share across repos, and environment secrets can sit behind required reviewers. Pick by blast radius.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.