DevSecOps
Zero Trust for CI/CD Pipelines: A Concrete Blueprint
CI/CD runners are a top attacker target. Here's a concrete zero-trust blueprint using OIDC federation, pinned action SHAs, and short-lived identities.
Mar 24, 20268 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CI/CD runners are a top attacker target. Here's a concrete zero-trust blueprint using OIDC federation, pinned action SHAs, and short-lived identities.
A practical, line-by-line walk through hardening Azure DevOps YAML pipelines — template injection, task version pinning, approvals, and the defaults that will bite you.
Security hardening for Travis CI pipelines covering secret management, build isolation, and migration considerations for teams still on the platform.
Securing Bitbucket Pipelines with secure variables, deployment permissions, and pipeline hardening.
Practical steps to secure your CircleCI pipelines, from context management and OIDC to orb vetting and runner isolation.
Hardening GitLab CI/CD pipelines with protected variables, secure runners, and built-in security scanning.
How to lock down your Azure DevOps pipelines against supply chain attacks, credential leaks, and unauthorized deployments.
CI/CD pipelines are the new attack surface. From poisoned dependencies to compromised build tools, here's how to lock down your software delivery infrastructure.
Weekly insights on software supply chain security, delivered to your inbox.