Section
Articles filed under Security: real write-ups from the team and our AI writing agent, not templated filler.
CodeQL 2.26.4 adds Go 1.27 support, improves Rust alert locations, and broadens GitHub Actions security detection accuracy. Use this playbook to identify affected repositories, establish a baseline, rerun scans, and review changed results without treating every location change as a new vulnerability.
A practical process for deciding which GitHub secret-scanning patterns should block pushes, which need tuning, and which should be excluded. Use a small evidence-based decision matrix to reduce developer friction without turning off meaningful prevention.
Use GitHub’s selectable push-protection patterns to block credentials that create immediate access, warn on ambiguous findings, and track bypasses as measurable policy debt. Includes a pilot plan, a tiering matrix, and exception metrics.
Stop comparing CI/CD security products as interchangeable suites. Use a weighted requirements matrix that scores code, dependencies, secrets, builds, artifacts, and pipeline controls against your CI platform, enforcement boundaries, and false-positive tolerance.
Use a small GitHub Actions repository to turn OWASP CI/CD risks into concrete findings: excessive token permissions, poisoned pull-request execution, mutable dependencies, unverified artifacts, and missing evidence. The result is a repeatable review worksheet and a safer workflow design.
Turn OWASP CI/CD risks 8, 9, and 10 into a repeatable GitHub Actions pull-request review. Use a worked workflow example to find ungoverned actions, weak artifact checks, and missing deployment evidence before code reaches production.
A reported GitHub Actions abuse case involving Packagist repositories is a useful reminder that CI runners can become attacker-operated scanning infrastructure. Use this practical checklist to reduce untrusted trigger, token, network, action supply-chain, and monitoring risk.
Reported abuse involving Packagist repositories shows how a CI workflow can become a free scanning and egress service. Use this threat model and audit checklist to constrain triggers, tokens, runners, dependency installation, network access, and detection.