Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2024-6678 allowed attackers to trigger GitLab CI/CD pipelines as arbitrary users, potentially accessing secrets and deploying malicious code through impersonated pipeline runs.
Researchers disclosed techniques to poison GitHub Actions artifacts, enabling code execution in CI/CD pipelines of downstream projects. The attack exploits trust assumptions in artifact sharing.
Dropbox's 2022 GitHub phishing incident began with a developer-targeted CircleCI lookalike campaign; the supply chain lessons centered on CI tokens and code.
Security hardening for Travis CI pipelines covering secret management, build isolation, and migration considerations for teams still on the platform.
How Dagger's containerized pipeline model improves CI/CD security with hermetic builds, portability, and reduced platform dependency.
A critical authentication bypass in TeamCity allowed unauthenticated attackers to gain admin access to CI/CD servers. State-sponsored groups exploited it to compromise software supply chains.
Practical steps to secure your CircleCI pipelines, from context management and OIDC to orb vetting and runner isolation.
Leveraging Harness platform security capabilities including governance policies, secret management, and pipeline security controls.
How to lock down Jenkins pipelines against credential theft, script injection, and unauthorized access with practical hardening steps.
Weekly insights on software supply chain security, delivered to your inbox.