Said OULMAKHZOUNE 
Introduction CI/CD pipelines are among the most privileged components in any modern software organization. They clone source code, access secrets, build artifacts, and deploy to production — often with minimal human oversight. Yet despite this extraordinary level of access, the trust models underpinning these pipelines are rarely made explicit. When a pipeline runs, it implicitly … Read more
“Shift left” has become one of the most widely adopted principles in DevSecOps. The idea is simple and appealing: move security earlier in the software development lifecycle to detect issues sooner, reduce costs, and improve overall security outcomes. Over time, “shift left” has evolved from a useful concept into a near-unquestioned dogma. Security scanning, testing, … Read more
Why GitLab CI Security Matters GitLab CI/CD pipelines are powerful — but with power comes risk. A misconfigured variable can leak secrets. An unscoped runner can execute malicious code. An unprotected environment can let a junior developer push straight to production. This cheat sheet gives you copy-paste YAML for every critical GitLab CI security control, … Read more
Software supply chain security has become one of the most discussed topics in modern security. Yet for many engineers, it remains poorly defined, overloaded with buzzwords, and often framed through compliance or tooling rather than engineering reality. This disconnect is dangerous. Most real-world supply chain compromises do not succeed because teams lack frameworks or scanners. … Read more
GitHub Actions has become one of the most widely adopted CI/CD platforms. Its flexibility, tight integration with GitHub repositories, and rich ecosystem make it attractive for teams of all sizes. At the same time, GitHub Actions runners have emerged as a critical attack surface in modern software supply chain attacks. Runners execute untrusted code, handle … Read more
Threat modeling is a well-established practice in application security. Teams routinely model threats against APIs, backend services, and production environments. However, CI/CD pipelines are often excluded from formal threat modeling exercises, despite being one of the most critical components of modern software systems. This is a dangerous gap. CI/CD pipelines sit at the intersection of … Read more
For years, application security programs have focused on production environments: hardening servers, patching vulnerabilities, deploying WAFs, and monitoring runtime behavior. That focus made sense when most meaningful compromises happened after deployment, by exploiting weaknesses in running applications. But modern attackers increasingly bypass production defenses. Instead of attacking the application at runtime, they compromise the systems … Read more
A practitioner’s guide to enterprise SAST in 2026: the tool landscape (Checkmarx, Fortify, Veracode, Snyk, SonarQube, Semgrep), a weighted RFP scoring model with real vendor scores, a reusable evaluation matrix, plus Java-specific integration and false-positive management.
A practitioner’s guide to securing Java across the full lifecycle: architecting a resilient SDLC after the Security Manager, comparing SAST and DAST, adding IAST and RASP at runtime, hardening Spring Boot, and sequencing it all into a governed CI/CD pipeline.
