Topic
Everything filed under owasp, across every section.
Use this pull-request review checklist to evaluate GitHub Actions workflows for excessive permissions, unsafe third-party actions, artifact promotion gaps, secret exposure, runner isolation, and missing audit evidence. Each control is mapped to the OWASP Top 10 CI/CD Security Risks and CISA/NSA CI/CD guidance.
Harden a GitHub Actions pipeline with a practical workflow baseline and repository checklist mapped to OWASP CI/CD risks. See exactly where to set token permissions, protect deployments, validate artifacts, pin actions, and retain useful audit evidence.
Compare native CI controls, specialist security tools, and unified platforms using a proof-of-value matrix tied to OWASP CI/CD risks. This worksheet tests real coverage for secrets, code, dependencies, infrastructure, artifact integrity, visibility, and developer friction.
Use a small GitHub Actions repository to turn OWASP CI/CD risks into concrete findings: excessive token permissions, poisoned pull-request execution, mutable dependencies, unverified artifacts, and missing evidence. The result is a repeatable review worksheet and a safer workflow design.
Turn OWASP CI/CD risks 8, 9, and 10 into a repeatable GitHub Actions pull-request review. Use a worked workflow example to find ungoverned actions, weak artifact checks, and missing deployment evidence before code reaches production.