Overview Dependency confusion is a supply chain attack that exploits how package managers resolve package names when both private (internal) and public registries are configured. When an attacker publishes a malicious package to a public registry using the same name as an internal private package — but with a higher version number — the package … Read more
Introduction: What Is SLSA and Why Should You Care? Supply-chain Levels for Software Artifacts — SLSA (pronounced “salsa”) — is a security framework created by Google and now maintained by the Open Source Security Foundation (OpenSSF). Its goal is deceptively simple: make it harder for attackers to tamper with the software you build and ship. … Read more
CI/CD pipelines have become the backbone of modern software delivery. But with that power comes significant risk. The OWASP Top 10 CI/CD Security Risks project catalogues the most critical attack vectors targeting continuous integration and continuous delivery systems. In this guide, we break down each risk with real-world examples, impact assessments, and actionable mitigations you … Read more
Introduction If you audit the secret stores of most CI/CD platforms today, you will find a graveyard of long-lived credentials: AWS access keys created years ago, GCP service account JSON keys shared across dozens of pipelines, GitHub Personal Access Tokens with broad scopes, and database passwords that have never been rotated. These static secrets are … Read more
Overview If your GitHub Actions workflows authenticate to AWS using AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY stored as repository secrets, you have a serious security problem. Those long-lived credentials never expire on their own, can be exfiltrated by any workflow step (including third-party actions), and give attackers persistent access to your AWS account if compromised. OpenID Connect (OIDC) … Read more
Introduction Securing your CI/CD pipeline is no longer optional — it is a foundational requirement for any modern software organization. As supply chain attacks grow in frequency and sophistication, the tools you embed into your build and deployment pipelines directly determine your security posture. But with a growing ecosystem of scanners, choosing the right one … Read more
Overview GitHub-hosted runners are shared and ephemeral by default — every job gets a fresh virtual machine that is destroyed after the job completes. Self-hosted runners, on the other hand, are persistent and shared across workflow runs. This creates a significant security risk: secrets, tokens, and build artifacts from one job can leak into the … Read more
Overview Software Bills of Materials (SBOMs) are rapidly becoming a mandatory component of software supply chain transparency. Executive orders, regulatory frameworks like NIST SSDF, and industry standards now require organizations to produce, distribute, and verify SBOMs for every software release. An SBOM lists every component, library, and dependency inside your software — giving consumers the … Read more
Overview Poisoned Pipeline Execution (PPE) ranks as the #2 risk in the OWASP CI/CD Security Top 10. It is a class of attacks where a malicious actor manipulates the build process by injecting code into pipeline definitions or build scripts, typically through a pull request. Once the CI system picks up the change, the attacker’s … Read more
A practitioner’s pillar guide to enterprise DAST in 2026: how DAST fits CI/CD, the 2026 tool landscape, a weighted RFP scoring matrix and vendor comparison, plus governance and false-positive management.
