CI/CD Security
A CI/CD pipeline typically holds more privilege than the production systems it deploys to. This covers the controls that keep it from being the easiest path to compromise: fork pull request handling, secret scoping, pinned dependencies, and separated build/deploy permissions.
T1195Supply Chain Compromise — the technique category most CI/CD pipeline controls exist to mitigateFeatured Resources
Related Resources
CI/CD Security Scanner
Run repository and dependency security scans automatically in GitHub Actions and GitLab CI — catch secrets, CVEs, and SAST findings before they merge.
Repository Security Scanner
Scan GitHub and GitLab repositories for hardcoded secrets, sensitive files, SAST vulnerabilities, and dependency CVEs — OWASP-mapped, OSV-backed.
Other Categories
Mobile Application Security
Static and dynamic analysis of Android and iOS applications, and the OWASP Mobile Top 10 framework findings map to.
Repository Security
Secret detection, dependency review, SAST patterns, and the access-control practices that keep a codebase auditable.
Secure SDLC
Treating security requirements as a design constraint from the start, not a review gate at the end.
Vulnerability Management
Turning raw findings into a prioritized, trackable backlog — beyond what a severity score alone can tell you.
Reverse Engineering
Manual analysis of compiled binaries — the toolchain and reasoning static analysis automates a subset of.
Software Supply Chain
Dependency provenance, build artifact integrity, and the trust boundaries every third-party package introduces.
Engineering Leadership
Making application security legible to the people who manage teams and answer for organizational risk.