Search
Results for “application-security”
- security
How to Audit Node.js Single Executable Applications Before Internal Distribution
Node.js Single Executable Applications simplify deployment, but they also make it easier to distribute an opaque runtime and application payload as one file. Build an audit workflow that inventories SEA artifacts, validates provenance, inspects bundled code, tests behavior, and applies endpoint allow/deny rules.
- security
How to Harden GitHub Actions Against Workflow Abuse, Repository Scanning, and Untrusted Pull Requests
A reported GitHub Actions abuse case involving Packagist repositories is a useful reminder that CI runners can become attacker-operated scanning infrastructure. Use this practical checklist to reduce untrusted trigger, token, network, action supply-chain, and monitoring risk.
- security
How to Choose CI/CD Security Tools With a Requirements Matrix
Stop comparing CI/CD security products as interchangeable suites. Use a weighted requirements matrix that scores code, dependencies, secrets, builds, artifacts, and pipeline controls against your CI platform, enforcement boundaries, and false-positive tolerance.
- security
Choose CI/CD Security Tools With a Risk-Based Evaluation Matrix
A buyer-oriented framework for selecting CI/CD security tools based on the risks in your actual delivery pipeline: code, dependencies, secrets, workflows, artifacts, and continuous validation.
- software-engineering
A Pull-Request-Ready GitHub Actions CI/CD Security Checklist
Use this five-minute GitHub Actions review checklist to block unsafe permissions, secret exposure, third-party action drift, untrusted artifacts, and missing audit signals before a workflow change merges.
- software-engineering
A GitHub Actions CI/CD Security Baseline: Pinned Actions, Scoped Secrets, Verified Artifacts, and Useful Logs
Harden a repository-level GitHub Actions pipeline with immutable action references, least-privilege tokens, environment-gated deployments, artifact checksums, and audit-friendly logs. Includes a practical workflow you can adapt for Node.js projects.
- security
A Practical OWASP CI/CD Security Review Worksheet for GitHub Actions Pull Requests
Turn OWASP CI/CD risks 8, 9, and 10 into a repeatable GitHub Actions pull-request review. Use a worked workflow example to find ungoverned actions, weak artifact checks, and missing deployment evidence before code reaches production.
- software-engineering
How to Choose CI/CD Security Tools With an OWASP-Based Proof-of-Value Scorecard
Compare native CI controls, specialist security tools, and unified platforms using a proof-of-value matrix tied to OWASP CI/CD risks. This worksheet tests real coverage for secrets, code, dependencies, infrastructure, artifact integrity, visibility, and developer friction.
- software-engineering
GitHub Actions CI/CD Security Review Checklist Mapped to OWASP and CISA
Use this pull-request review checklist to evaluate GitHub Actions workflows for excessive permissions, unsafe third-party actions, artifact promotion gaps, secret exposure, runner isolation, and missing audit evidence. Each control is mapped to the OWASP Top 10 CI/CD Security Risks and CISA/NSA CI/CD guidance.
- software-engineering
CI/CD Security Tools in 2026: A Minimal Stack for GitHub Actions Without Overlapping Scanners
Build CI/CD security around the pipeline controls that matter: source, dependencies, secrets, workflow behavior, artifacts, and deployment. Compare practical tools for each control and choose a lean GitHub Actions stack for a small project or a growing engineering organization.
- software-engineering
A Copyable GitHub Actions CI/CD Security Baseline for Permissions, Secrets, Artifacts, and Action Pinning
Harden a GitHub Actions pipeline with a practical workflow baseline and repository checklist mapped to OWASP CI/CD risks. See exactly where to set token permissions, protect deployments, validate artifacts, pin actions, and retain useful audit evidence.
- security
CodeQL 2.26.4 Upgrade Checklist for Go, Rust, and GitHub Actions Repositories in 2026
CodeQL 2.26.4 adds Go 1.27 support, improves Rust alert locations, and broadens GitHub Actions security detection accuracy. Use this playbook to identify affected repositories, establish a baseline, rerun scans, and review changed results without treating every location change as a new vulnerability.
- security
GitHub Secret Scanning Triage: Block Real Leaks Without Making Push Protection Noisy
A practical process for deciding which GitHub secret-scanning patterns should block pushes, which need tuning, and which should be excluded. Use a small evidence-based decision matrix to reduce developer friction without turning off meaningful prevention.
- software-engineering
How to Pin actions/download-artifact to a Commit SHA and Upgrade Safely to v4
A repeatable procedure for moving GitHub Actions workflows from a mutable download-artifact tag to an audited v4 commit SHA. Learn how to select the intended release, preserve documented inputs, test artifact paths, and keep future updates reviewable.
- security
Hardening GitHub Actions Against Repository-Scanning Abuse: A Worked Checklist
Reported abuse involving Packagist repositories shows how a CI workflow can become a free scanning and egress service. Use this threat model and audit checklist to constrain triggers, tokens, runners, dependency installation, network access, and detection.
- software-engineering
GitHub Immutable Releases vs Tag Rulesets: A Secure v1.* Release Configuration
GitHub tag rulesets stop unauthorized tags from being created, moved, or deleted before release publication. Immutable releases protect the tag and downloadable assets after publication; use both for v1.* production releases.
- software-engineering
A Practical Scorecard for Measuring Open-Source Dependency Reuse
As dependency reuse grows, a package list is not enough. This engineering scorecard turns inventory, update cadence, provenance review, and abandoned-package exposure into measurable controls that teams can use in planning and release reviews.
- software-engineering
Signed Git Tag Verification: Check the Signature and the Commit Before Publishing
A valid signature is only one part of release provenance. Verify the annotated tag, authorize its signer by fingerprint, compare its target with an independently approved commit, and build from that commit.
- software-engineering
A 55-Minute GitHub Actions Hardening Audit: Pin Actions, Restrict Tokens, Review Dependencies
Turn GitHub Actions security guidance into a time-boxed repository audit. Find mutable action references, overpowered tokens, risky triggers, and third-party dependencies, then prioritize fixes by blast radius and effort.
- software-engineering
How to Protect Git Tag Production Deployments in GitHub Actions with Rulesets and Environments
GitHub tag rulesets and environment protection solve different deployment risks. This worked production flow uses both: only release managers can create immutable version tags, and only approved tags can request access to the production environment.
- security
Tune GitHub Secret Scanning Push Protection by Risk, Not by Every Possible Pattern
Use GitHub’s selectable push-protection patterns to block credentials that create immediate access, warn on ambiguous findings, and track bypasses as measurable policy debt. Includes a pilot plan, a tiering matrix, and exception metrics.
- software-engineering
A Pre-Launch GenAI Risk Checklist for Internal Chatbots and Developer Tools
Turn NIST’s generative AI risk guidance into a practical release gate for a coding assistant, repository chatbot, or internal support bot. Use this checklist to test data exposure, harmful outputs, human review, evaluation coverage, and incident response before enabling real users.
- software-engineering
A Staged Playbook for GitHub Push Protection Custom Patterns Without Blocking Developers
Use audit-only testing, false-positive measurement, and a two-tier policy to tune GitHub push protection custom patterns. Block credentials that create immediate exposure; route ambiguous matches into a warning-and-review workflow.
- engineering
A 4-Pass GitHub Actions Audit for Supply-Chain Exposure Before the Next Dependency Incident
Audit GitHub Actions workflows before a dependency compromise forces rushed decisions. This repeatable method maps third-party actions, package installs, secrets, artifact handoffs, and blast radius into a remediation queue.
- security
Threat-Model a GitHub Actions Workflow Against the OWASP CI/CD Top 10
Use a small GitHub Actions repository to turn OWASP CI/CD risks into concrete findings: excessive token permissions, poisoned pull-request execution, mutable dependencies, unverified artifacts, and missing evidence. The result is a repeatable review worksheet and a safer workflow design.
- software-engineering
GitHub Protected Tags Migration: A Release Pipeline and Deployment Checklist
Migrate legacy GitHub tag protections without breaking release automation or accidentally bypassing production environment controls. This playbook inventories tag dependencies, separates tag authorization from deployment authorization, and tests the cutover safely.
- software-engineering
GitHub Protected Tag Migration in 2026: Translate Tag Policies into Rulesets
Replace retired GitHub protected-tag rules without accidentally allowing release tags to be moved, deleted, or recreated. This walkthrough maps common legacy policies to tag-targeting rulesets, fnmatch patterns, bypass choices, and practical verification steps.
- software-engineering
A Practical Jenkins Hardening Runbook: Reduce Plugin Risk and Remove Internet Exposure
Use this remediation runbook to inventory Jenkins plugins, prioritize updates by reachable risk, remove unnecessary public exposure, restrict administration, and prove the server is safer after each change.
- software-engineering
GitHub Protected Tags in 2026: An Audit and Migration Checklist After the Sunset
GitHub’s legacy tag protection sunset is not just a settings migration. Use this practical checklist to inventory release tags, verify migrated tag rulesets, test controls in a low-risk repository, and assign long-term ownership.
- software-engineering
Don’t Replace Protected Tags With Immutable Releases Alone: A 9-Step GitHub Migration
GitHub immutable releases prevent published release tags and assets from being changed, but they do not govern who may create a tag in the first place. Use this migration checklist to pair immutable releases with tag rulesets, CI identities, and a tested release workflow.