Search
Results for “application-security”
- security
How to Harden GitHub Actions Against Workflow Abuse, Repository Scanning, and Untrusted Pull Requests
A reported GitHub Actions abuse case involving Packagist repositories is a useful reminder that CI runners can become attacker-operated scanning infrastructure. Use this practical checklist to reduce untrusted trigger, token, network, action supply-chain, and monitoring risk.
- security
How to Choose CI/CD Security Tools With a Requirements Matrix
Stop comparing CI/CD security products as interchangeable suites. Use a weighted requirements matrix that scores code, dependencies, secrets, builds, artifacts, and pipeline controls against your CI platform, enforcement boundaries, and false-positive tolerance.
- security
Choose CI/CD Security Tools With a Risk-Based Evaluation Matrix
A buyer-oriented framework for selecting CI/CD security tools based on the risks in your actual delivery pipeline: code, dependencies, secrets, workflows, artifacts, and continuous validation.
- software-engineering
A Pull-Request-Ready GitHub Actions CI/CD Security Checklist
Use this five-minute GitHub Actions review checklist to block unsafe permissions, secret exposure, third-party action drift, untrusted artifacts, and missing audit signals before a workflow change merges.
- software-engineering
A GitHub Actions CI/CD Security Baseline: Pinned Actions, Scoped Secrets, Verified Artifacts, and Useful Logs
Harden a repository-level GitHub Actions pipeline with immutable action references, least-privilege tokens, environment-gated deployments, artifact checksums, and audit-friendly logs. Includes a practical workflow you can adapt for Node.js projects.
- security
A Practical OWASP CI/CD Security Review Worksheet for GitHub Actions Pull Requests
Turn OWASP CI/CD risks 8, 9, and 10 into a repeatable GitHub Actions pull-request review. Use a worked workflow example to find ungoverned actions, weak artifact checks, and missing deployment evidence before code reaches production.
- software-engineering
How to Choose CI/CD Security Tools With an OWASP-Based Proof-of-Value Scorecard
Compare native CI controls, specialist security tools, and unified platforms using a proof-of-value matrix tied to OWASP CI/CD risks. This worksheet tests real coverage for secrets, code, dependencies, infrastructure, artifact integrity, visibility, and developer friction.
- software-engineering
GitHub Actions CI/CD Security Review Checklist Mapped to OWASP and CISA
Use this pull-request review checklist to evaluate GitHub Actions workflows for excessive permissions, unsafe third-party actions, artifact promotion gaps, secret exposure, runner isolation, and missing audit evidence. Each control is mapped to the OWASP Top 10 CI/CD Security Risks and CISA/NSA CI/CD guidance.
- software-engineering
CI/CD Security Tools in 2026: A Minimal Stack for GitHub Actions Without Overlapping Scanners
Build CI/CD security around the pipeline controls that matter: source, dependencies, secrets, workflow behavior, artifacts, and deployment. Compare practical tools for each control and choose a lean GitHub Actions stack for a small project or a growing engineering organization.
- software-engineering
A Copyable GitHub Actions CI/CD Security Baseline for Permissions, Secrets, Artifacts, and Action Pinning
Harden a GitHub Actions pipeline with a practical workflow baseline and repository checklist mapped to OWASP CI/CD risks. See exactly where to set token permissions, protect deployments, validate artifacts, pin actions, and retain useful audit evidence.
- security
CodeQL 2.26.4 Upgrade Checklist for Go, Rust, and GitHub Actions Repositories in 2026
CodeQL 2.26.4 adds Go 1.27 support, improves Rust alert locations, and broadens GitHub Actions security detection accuracy. Use this playbook to identify affected repositories, establish a baseline, rerun scans, and review changed results without treating every location change as a new vulnerability.
- security
GitHub Secret Scanning Triage: Block Real Leaks Without Making Push Protection Noisy
A practical process for deciding which GitHub secret-scanning patterns should block pushes, which need tuning, and which should be excluded. Use a small evidence-based decision matrix to reduce developer friction without turning off meaningful prevention.
- software-engineering
How to Pin actions/download-artifact to a Commit SHA and Upgrade Safely to v4
A repeatable procedure for moving GitHub Actions workflows from a mutable download-artifact tag to an audited v4 commit SHA. Learn how to select the intended release, preserve documented inputs, test artifact paths, and keep future updates reviewable.
- security
Hardening GitHub Actions Against Repository-Scanning Abuse: A Worked Checklist
Reported abuse involving Packagist repositories shows how a CI workflow can become a free scanning and egress service. Use this threat model and audit checklist to constrain triggers, tokens, runners, dependency installation, network access, and detection.
- software-engineering
A Practical Scorecard for Measuring Open-Source Dependency Reuse
As dependency reuse grows, a package list is not enough. This engineering scorecard turns inventory, update cadence, provenance review, and abandoned-package exposure into measurable controls that teams can use in planning and release reviews.
- software-engineering
A 55-Minute GitHub Actions Hardening Audit: Pin Actions, Restrict Tokens, Review Dependencies
Turn GitHub Actions security guidance into a time-boxed repository audit. Find mutable action references, overpowered tokens, risky triggers, and third-party dependencies, then prioritize fixes by blast radius and effort.
- engineering
A 4-Pass GitHub Actions Audit for Supply-Chain Exposure Before the Next Dependency Incident
Audit GitHub Actions workflows before a dependency compromise forces rushed decisions. This repeatable method maps third-party actions, package installs, secrets, artifact handoffs, and blast radius into a remediation queue.
- security
Threat-Model a GitHub Actions Workflow Against the OWASP CI/CD Top 10
Use a small GitHub Actions repository to turn OWASP CI/CD risks into concrete findings: excessive token permissions, poisoned pull-request execution, mutable dependencies, unverified artifacts, and missing evidence. The result is a repeatable review worksheet and a safer workflow design.
- security
Tune GitHub Secret Scanning Push Protection by Risk, Not by Every Possible Pattern
Use GitHub’s selectable push-protection patterns to block credentials that create immediate access, warn on ambiguous findings, and track bypasses as measurable policy debt. Includes a pilot plan, a tiering matrix, and exception metrics.
- software-engineering
A Pre-Launch GenAI Risk Checklist for Internal Chatbots and Developer Tools
Turn NIST’s generative AI risk guidance into a practical release gate for a coding assistant, repository chatbot, or internal support bot. Use this checklist to test data exposure, harmful outputs, human review, evaluation coverage, and incident response before enabling real users.
- software-engineering
A Staged Playbook for GitHub Push Protection Custom Patterns Without Blocking Developers
Use audit-only testing, false-positive measurement, and a two-tier policy to tune GitHub push protection custom patterns. Block credentials that create immediate exposure; route ambiguous matches into a warning-and-review workflow.
- software-engineering
A Practical Jenkins Hardening Runbook: Reduce Plugin Risk and Remove Internet Exposure
Use this remediation runbook to inventory Jenkins plugins, prioritize updates by reachable risk, remove unnecessary public exposure, restrict administration, and prove the server is safer after each change.
- ci-cd
A Reviewer Playbook for AI-Generated GitHub Actions Workflows
AI-generated GitHub Actions YAML can be syntactically correct while creating a direct path from a forked pull request to repository credentials. Use this workflow-specific review playbook to inspect permissions, action pins, triggers, interpolation, secrets, and checkout context before merging.
- developer-tools
A Practical Workflow for Monitoring GitHub Platform and Copilot Changes Without Reading Every Changelog
Use the GitHub Changelog as your source of record and a release-notes aggregator as an early-warning layer. This workflow shows how to triage Copilot, Actions, security, CLI, and Enterprise updates into ignore, review, test, or act-now decisions.
- software-engineering
How to Choose Immutable Tags or Commit SHA Pins for GitHub Actions
A practical comparison of mutable tags, immutable release references, and full commit-SHA pins for GitHub Actions. Use actions/download-artifact to choose a policy that balances supply-chain security, readable reviews, automated updates, and fast rollback.
