Topics / Build Securely / CI/CD and Software Supply-Chain Security
CI/CD and Software Supply-Chain Security
Secure build, release, and dependency workflows.
Intended audience: Beginners, practitioners, and security engineers relevant to this discipline.
9 results
Threat Modeling a CI/CD Pipeline
A structured method for threat modeling a CI/CD pipeline's trust boundaries — from commit to deployment — using a fictional example pipeline.
Protecting the Main Branch Beyond Pull-Request Approval
Why a single required approval is not by itself a defensible main-branch control, and how required status checks, force-push protection, and branch ruleset enforcement close the gap.
Why Build Runners Should Be Treated as Untrusted
The ephemeral environment that actually runs build and install scripts combines code execution, network egress, and short-lived credentials in one place — why that makes it the pipeline's highest-value target, and what isolation, ephemerality, and least-privilege controls actually limit the resulting blast radius.
SBOMs: What They Solve and What They Do Not
A Software Bill of Materials gives fast, accurate vulnerability-impact assessment against a known component inventory — and nothing more. What it does not do: prove the software is safe, verify build integrity, stop a malicious dependency from being included, or exceed the accuracy of its own generation process.
Least Privilege for Pipeline Identities
How to recognize when a CI/CD pipeline identity — a service account, OIDC-federated role, or deploy token — carries more privilege than the job it serves actually needs, and how to reduce that privilege deliberately, in stages, without breaking the pipeline.
Verifying Build Artifacts Before Deployment
Why a successful deploy step is not evidence that the artifact it shipped is the one your pipeline built from reviewed source, and how to verify that with checksums, cryptographic signatures, and build provenance/attestation before a deploy step is allowed to run.
Preventing Secrets from Entering Build Logs
The concrete mechanisms by which a secret ends up printed in a CI/CD build log — verbose output, environment dumps, error messages, a tool echoing its own arguments — how to prevent each one, and why a secret found in a log must be rotated, not just redacted.
Designing Human Approval Gates for Production Changes
How to design a human-approval gate for a production change — a deploy, a configuration change, an infrastructure change — that provides a meaningful check instead of a rubber-stamp click: what an approver actually needs to see, why instant unanimous approval is a red flag, separation of duties, and what can safely skip a human gate.
Hardening a Private Gitea Server
A self-hosted Gitea instance is both source-of-truth for code and, once Actions or webhooks are involved, part of the supply chain. Concrete hardening steps for authentication and enforced 2FA, SSH and deploy-key scoping, webhook secret verification, repository and organization access control, patch cadence, backup, and network exposure — illustrated with a fictional organization throughout.
Related categories