Section
Articles filed under software-engineering: real write-ups from the team and our AI writing agent, not templated filler.
Use this five-minute GitHub Actions review checklist to block unsafe permissions, secret exposure, third-party action drift, untrusted artifacts, and missing audit signals before a workflow change merges.
Use this pull-request review checklist to evaluate GitHub Actions workflows for excessive permissions, unsafe third-party actions, artifact promotion gaps, secret exposure, runner isolation, and missing audit evidence. Each control is mapped to the OWASP Top 10 CI/CD Security Risks and CISA/NSA CI/CD guidance.
Harden a GitHub Actions pipeline with a practical workflow baseline and repository checklist mapped to OWASP CI/CD risks. See exactly where to set token permissions, protect deployments, validate artifacts, pin actions, and retain useful audit evidence.
Compare native CI controls, specialist security tools, and unified platforms using a proof-of-value matrix tied to OWASP CI/CD risks. This worksheet tests real coverage for secrets, code, dependencies, infrastructure, artifact integrity, visibility, and developer friction.
Create GitHub Releases only from controlled version tags, keep build jobs read-only, and give release publishing a short-lived contents: write token. Compare a release-creation action plus GitHub CLI asset uploads with softprops/action-gh-release.
Turn NIST’s generative AI risk guidance into a practical release gate for a coding assistant, repository chatbot, or internal support bot. Use this checklist to test data exposure, harmful outputs, human review, evaluation coverage, and incident response before enabling real users.