Said OULMAKHZOUNE 
Introduction Most CI/CD pipelines start with a simple goal: get code from a developer’s machine into production as fast as possible. Along the way, someone creates a service account, grants it broad permissions, stores the credentials as a pipeline secret, and moves on. It works. Builds pass, deployments succeed, and nobody thinks about it again … Read more
CI/CD pipelines are among the most privileged workloads in any organization. They pull source code, download dependencies, access secrets, and push artifacts to production registries. Yet in many environments, the build processes behind these pipelines run with unrestricted network access and full filesystem permissions — a combination that represents one of the most exploitable gaps … Read more
Overview Dependency confusion is a supply chain attack that exploits how package managers resolve package names when both private (internal) and public registries are configured. When an attacker publishes a malicious package to a public registry using the same name as an internal private package — but with a higher version number — the package … Read more
Introduction: What Is SLSA and Why Should You Care? Supply-chain Levels for Software Artifacts — SLSA (pronounced “salsa”) — is a security framework created by Google and now maintained by the Open Source Security Foundation (OpenSSF). Its goal is deceptively simple: make it harder for attackers to tamper with the software you build and ship. … Read more
CI/CD pipelines have become the backbone of modern software delivery. But with that power comes significant risk. The OWASP Top 10 CI/CD Security Risks project catalogues the most critical attack vectors targeting continuous integration and continuous delivery systems. In this guide, we break down each risk with real-world examples, impact assessments, and actionable mitigations you … Read more
Introduction If you audit the secret stores of most CI/CD platforms today, you will find a graveyard of long-lived credentials: AWS access keys created years ago, GCP service account JSON keys shared across dozens of pipelines, GitHub Personal Access Tokens with broad scopes, and database passwords that have never been rotated. These static secrets are … Read more
Overview If your GitHub Actions workflows authenticate to AWS using AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY stored as repository secrets, you have a serious security problem. Those long-lived credentials never expire on their own, can be exfiltrated by any workflow step (including third-party actions), and give attackers persistent access to your AWS account if compromised. OpenID Connect (OIDC) … Read more
Introduction Securing your CI/CD pipeline is no longer optional — it is a foundational requirement for any modern software organization. As supply chain attacks grow in frequency and sophistication, the tools you embed into your build and deployment pipelines directly determine your security posture. But with a growing ecosystem of scanners, choosing the right one … Read more
Overview GitHub-hosted runners are shared and ephemeral by default — every job gets a fresh virtual machine that is destroyed after the job completes. Self-hosted runners, on the other hand, are persistent and shared across workflow runs. This creates a significant security risk: secrets, tokens, and build artifacts from one job can leak into the … Read more
Overview Software Bills of Materials (SBOMs) are rapidly becoming a mandatory component of software supply chain transparency. Executive orders, regulatory frameworks like NIST SSDF, and industry standards now require organizations to produce, distribute, and verify SBOMs for every software release. An SBOM lists every component, library, and dependency inside your software — giving consumers the … Read more
