Said OULMAKHZOUNE 
Introduction: Why Policy Engines Matter for CI/CD Modern CI/CD pipelines move fast. Teams push dozens — sometimes hundreds — of deployments per day, and every one of those deployments carries configuration decisions that affect security, compliance, and operational stability. A single misconfigured Kubernetes manifest, an overly permissive IAM role in Terraform, or a container image … Read more
Why SBOMs Matter: The Regulatory and Security Imperative A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency that makes up a piece of software. Think of it as the nutritional label for your application — except instead of calories and sodium, you’re listing packages, versions, licenses, and … Read more
Why Container Image Signing Matters Every time you pull a container image and deploy it into production, you’re placing implicit trust in that artifact. But how do you verify that the image hasn’t been tampered with? How do you confirm it was actually built by your CI/CD pipeline and not injected by an attacker who … Read more
Introduction Code signing has long been a cornerstone of software security. When you verify a signature, you know who signed an artifact. But knowing who signed something does not tell you how it was built, where it was built, or what source code went into it. A maintainer could sign a binary that was compiled … Read more
Overview Misconfigured Kubernetes manifests are one of the top causes of production security incidents. A container running as root, an unpinned image tag, a missing resource limit, or an exposed host network can each open the door to privilege escalation, resource exhaustion, or lateral movement inside your cluster. The problem is that these misconfigurations are … Read more
Overview Secret leaks in CI/CD pipelines are the number one cause of pipeline compromise. Exposed credentials — API keys, database passwords, cloud access tokens — give attackers a direct path into production systems. According to GitGuardian’s 2025 State of Secrets Sprawl report, over 12 million new secrets were detected in public GitHub commits in a … Read more
Overview GitHub Actions has become the most widely adopted CI/CD platform for open-source and commercial software alike. That popularity makes it the number-one attack surface in the CI/CD landscape. Misconfigured workflows routinely leak secrets, grant excessive permissions, and pull in third-party code that can be silently tampered with. In this hands-on lab you will harden … Read more
Overview SLSA (Supply-chain Levels for Software Artifacts) provenance is a verifiable record that describes how an artifact was built: the source repository, the build platform, the entry point, and the input materials. When attached to a container image, provenance lets consumers answer a critical question before deploying: “Was this image actually built from the source … Read more
Overview Every container image your CI/CD pipeline produces should be cryptographically signed before it reaches any environment. Unsigned images are a blind spot — you have no proof they came from your pipeline, no guarantee they weren’t tampered with in transit, and no policy hook to block rogue deployments. In this hands-on lab you will: … Read more
Overview GitLab CI is the second most widely used CI/CD platform in the industry, powering millions of pipelines across organizations of every size. Its tight integration with source control makes it exceptionally convenient — but that same integration creates a broad attack surface if pipelines are not deliberately hardened. In this hands-on lab you will … Read more
