#cicdsecurity

Security Quality Gates in GitHub, GitLab & Bitbucket Learn how to enforce security...

When a rogue container slips into production, the fallout can be catastrophic. Discover how build signing and Sigstore lock down your CI/CD chain, giving attack

Secrets Scanning in CI/CD: Stop Token Leaks Discover how API keys and tokens end up in...

A Docker-sponsored Omdia report pegs the twelve-month software supply-chain incident rate at 77 percent of surveyed organizations, with AI technology now ranked as the top supply-chain risk. The tool-effectiveness table rewards the sponsor's product category.

Google's Threat Intelligence Group and Mandiant have released a joint guide on defending against software supply chain compromise, mapping four control categories onto the concrete pipeline levers most teams already own: short-lived tokens, ephemeral runners, package cooldowns and dependency verification.

GitHub has flipped Actions into a hold-first posture for workflow runs it flags as potentially malicious on public repositories: the run pauses until a collaborator with write access approves it from an authenticated web session. The change targets a wave of credential-theft attacks that push booby-trapped workflow files with stolen tokens.

Novee Security disclosed a CI/CD flaw pattern, Cordyceps, that an unauthenticated actor can use to plant self-propagating triggers across pipelines. The specifics matter less than the shape: pipelines keep landing on the attack surface, and organizations keep treating them like build tools.

The Megalodon campaign injected malicious CI/CD workflows into 5,561 repos using forged bot identities. Cloud credentials, SSH keys, and OIDC tokens were harvested at scale. Here's what happened and how to protect your pipeline.

A New Stack analysis argues agentic systems pass functional review and then stall at the security gate because no one scoped identity, permissions or audit at the platform layer first. For CI/CD owners, it pushes a familiar workload-identity problem onto a much larger fleet of callers.

The Cilium project's third post in its CI/CD hardening series walks through how it manages credentials and verifies what it ships, then lists the parts it has not fixed yet. The unusual move is publishing the unfinished work.

Learn how to shift Dockerfile security left in your CI/CD pipeline with actionable DevSecOps practices — automated scanning, policy-as-code, SBOM gene

Originally published at norvik.tech Introduction A deep dive into the critical...