Want to Be a DevSecOps Engineer? Then You Need This Tool Stack!
What to run at each pipeline stage (secrets, SAST, SBOM, image, IaC, admission, DAST, runtime), what should block, and a minimal workflow.
Tag
#ci-cd
3 posts with this tag
Pipeline Hijacking! An Offensive Perspective on CI/CD and the Hunt for Credentials
How attackers steal credentials from a CI/CD runner, and how to shut them out with OIDC, SHA pinning and admission-time verification.
The 7 Critical Mistakes Every DevSecOps Engineer Must Avoid in Their Pipeline
Seven pipeline mistakes and their fixes: Semgrep on the PR, a Snyk gate, CVSS with EPSS and KEV, pinned Actions, gitleaks, OIDC and ZAP in staging.