Threat-models pipelines for a living. Assumes every dependency is guilty until signed. Writes with a verdict and a wink.
By Tomás
61 articlesGTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams
Google's Threat Intelligence Group and Mandiant have released a joint guide on defending against software supply chain compromise, mapping four control categories onto the concrete pipeline levers most teams already own: short-lived tokens, ephemeral runners, package cooldowns and dependency verification.
Jul 30, 2026Security & supply chainOpenAI open-sources the Codex Security CLI and keeps the scanner in-house
OpenAI has released the Codex Security CLI and SDK under Apache 2.0, wiring pre-commit and CI scanning into the merge path with configurable severity gates. The scanning backend and the agent that produces threat models and patches remain proprietary and available only to a limited-beta allowlist.
Jul 30, 2026Security & supply chainDocker's fourth horror story revisits the Nx post-install hook that drained CI secrets
The fourth installment of Docker's Coding Agent Horror Stories, published July 28, revisits the August 2025 s1ngularity compromise of the Nx npm package. The lesson for CI/CD teams has nothing to do with coding agents. It is about the post-install hook that ran telemetry.js on every runner that pulled the package.
Jul 29, 2026Security & supply chainGitHub Actions freezes suspected-malicious workflow runs until a human signs off
GitHub has flipped Actions into a hold-first posture for workflow runs it flags as potentially malicious on public repositories: the run pauses until a collaborator with write access approves it from an authenticated web session. The change targets a wave of credential-theft attacks that push booby-trapped workflow files with stolen tokens.
Jul 28, 2026Security & supply chainConfidential Containers hits CNCF incubation, and every pipeline is on notice
The CNCF Technical Oversight Committee voted Confidential Containers into incubation on July 22, moving TEE-backed pods one step closer to being a normal part of the Kubernetes stack. If your pipeline already signs and attests images, the runtime side is about to demand the same discipline.
Jul 25, 2026Security & supply chainAuditors, OIDC and the trust policy most teams get wrong
A DevOps.com walkthrough by Artur Yolchyan lays out a SOC 2-shaped CI/CD pipeline on GitHub Actions and AWS: multi-account isolation, OIDC federation locked to one repo and branch, and the same container image retagged all the way to production. The interesting part is not the account topology; it is the one line in the trust policy that decides who can talk to your ECR.
Jul 24, 2026Code quality & testingGitHub Code Quality goes GA, and the billing meter turns on with it
GitHub Code Quality moved to general availability on GitHub Enterprise Cloud and GitHub Team on July 20, pairing CodeQL's analysis with AI-assisted detection and Copilot Autofix inside pull requests. The pricing landed the same day: $10 per active committer per month plus usage charges for AI work and CodeQL compute.
Jul 22, 2026Security & supply chainTime-to-exploit went negative. Mandiant maps where AI helps the vulnerability queue, and where it fails silently.
Google Cloud's Mandiant team pins mean time-to-exploit at negative seven days and publishes a blueprint for aiming large language models at the vulnerability pipeline. The failure modes it lists are the ones that let the exploit through.
Jul 22, 2026Security & supply chainThe npm worm that shipped with valid SLSA provenance
A DevOps.com analysis of the Miasma npm worm makes an uncomfortable case: signing and provenance told the honest truth, and the pipeline still shipped malware. When the build platform itself is the attack surface, a green attestation is a description of the failure, not a defence against it.
Jul 22, 2026Security & supply chainCodeMender opens in preview: Google Cloud puts an agent on the security fix
Google Cloud has opened a preview of CodeMender, a managed agent that both scans code and proposes remediations, delivered through the Gemini Enterprise Agent Platform and AI Threat Defense. It puts a fresh trust question in front of every CI/CD team: which security fixes are safe to auto-apply, and where does a human still sign?
Jul 21, 2026Security & supply chainxAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys
Three days after a researcher demonstrated the Grok Build CLI silently uploading SSH keys and repository contents to xAI's cloud, xAI dropped the agent's full source on GitHub under Apache 2.0. The code is now inspectable. The trust model is a different question.
Jul 21, 2026Security & supply chainServerless without a front door: Mandiant's hardening checklist for exposed Cloud Run functions
Google Cloud's Mandiant team published a hardening guide for teams shipping public serverless functions that carry no authentication. Its recommendations put a load balancer, per-function IAM, and pipeline-side security scanning between the internet and your code.
Jul 20, 2026Security & supply chainThe workstation is in scope now
A DevOps.com essay argues the laptop that pushes commits belongs inside the supply-chain threat model, citing the Megalodon campaign that injected malicious GitHub Actions workflows into thousands of repositories and a separate malicious VS Code extension incident. What CI-side controls actually catch this, and where the pipeline runs out of leverage.
Jul 19, 2026Security & supply chainOpenAI ships GPT-Red to automate prompt-injection testing against AI agents
OpenAI has released GPT-Red, a tool that automates prompt-injection testing against AI agents, per The New Stack. The framing is straightforward: once agents take real actions on real systems, manual red-teaming stops being enough.
Jul 18, 2026Supply chain securityGitLab tries to auto-fix the transitive-dep problem it keeps quantifying
GitLab has moved Dependency Scanning Auto-Remediation into beta, aimed squarely at the transitive supply-chain risk it just spent a research cycle measuring. The interesting question is not whether the fix ships, but whether anyone downstream trusts the bot enough to merge it.
Jul 17, 2026Supply-chain securityCordyceps: when a stranger's pull request runs as a maintainer
Researchers at Novee catalogue Cordyceps, a class of CI/CD supply-chain exploit where pull requests and comments from untrusted contributors get executed with maintainer permissions. A scan of 30,000 high-impact repositories flagged 654 candidates and confirmed over 300 as fully exploitable, with named blast radius inside Microsoft, Google, Apache and Cloudflare.
Jul 16, 2026Incident responseAWS teaches its DevOps Agent to open the pull request too
An AWS DevOps Blog walk-through chains the AWS DevOps Agent with the Kiro CLI so incident findings become a pull request instead of a Slack thread. The pipeline still gates on human approval, but who wrote the diff has changed, and so has what your review is actually catching.
Jul 15, 2026Security & supply chainGitHub pulls /security-review out of the CLI and into the Copilot app
GitHub's /security-review slash command is now in public preview inside the Copilot app, running a security pass on in-flight code changes before they ever reach a pull request. It is the same review that was already in the Copilot CLI, moved closer to where the code is being written.
Jul 15, 2026Supply chain securityDependabot learns to wait: version-update PRs now sit for three days by default
GitHub is flipping Dependabot version updates to a default three-day package cooldown. A new release has to sit on its registry for at least three days before Dependabot will open a version-update PR; security updates are exempt and still open immediately.
Jul 15, 2026Security & supply chaink8s-aibom writes down the AI your cluster is already running
Google Cloud open-sourced k8s-aibom, an unprivileged Kubernetes controller that watches the cluster API for inference runtimes and agent frameworks and emits OWASP CycloneDX ML-BOMs from what it finds. The bet is that shadow-AI inventory is easier to solve from outside the workload than by asking developers to fill in a form.
Jul 14, 2026Supply-chain securityThe five-minute SBOM sniff test earns its keep
A quick, deliberate look at the bill of materials for a hardened image catches supply-chain trouble a CVE scanner will never flag. Bolt it into the pipeline, not the compliance report.
Jul 13, 2026Supply-chain securityHalluSquatting: the dependency your agent invented, and the attacker who registered it first
Researchers from Tel Aviv University, the Technion, and Intuit describe a supply-chain pattern, HalluSquatting, that turns an AI coding agent's tendency to hallucinate package and repository names into a delivery channel for remote code execution and botnet payloads. The novelty is in the delivery, not the malware.
Jul 13, 2026Supply-chain securityInnersource security advisories go GA: a private channel for private vulns
GitHub Advanced Security now lets enterprise customers publish security advisories that stay inside the enterprise, and Dependabot picks them up like it would a public CVE. Useful, narrow, and only as good as the discipline behind it.
Jul 11, 2026Security & supply chainGhostApproval: six AI coding agents shipped a permission dialog that was reading the wrong path
Researchers at Google-owned Wiz disclosed GhostApproval, a class of flaw across six AI coding tools in which symbolic links redirect the agent's file writes while the human approval prompt shows the pre-resolution path. The mechanism is thirty years old; the CI/CD lesson is newer.
Jul 10, 2026Supply chain securitynpm v12 flips install-time to closed-by-default
npm v12 shipped as latest on July 8, 2026, with lifecycle scripts, git-URL dependencies and remote-URL dependencies all off by default at install time. Alongside it, the 2FA-bypass Granular Access Token starts a two-step retirement that ends direct publishes.
Jul 9, 2026Security & supply chainsetup-java 5.5.0 adds JDK signature verification, if you remember to enable it
GitHub's actions/setup-java 5.5.0 adds opt-in GPG signature verification for downloaded JDKs, plus a Kona distribution parameter and a set of Maven quality fixes. It closes a real supply-chain gap for Java CI jobs, but existing pipelines keep pulling unsigned JDKs until someone flips the switch.
Jul 9, 2026Security & supply chainThe SBOM you can trust is the one your build actually made
Docker published a guide arguing that SBOMs generated at build time beat post-build scans on completeness, accuracy and freshness. The distinction quietly changes what a CI pipeline is on the hook for.
Jul 8, 2026Supply-chain securityPolinRider keeps expanding, and the postinstall still lands on your runner
DevOps.com reports two DPRK-linked groups are expanding PolinRider, a supply-chain campaign that pushes malicious packages into developer workflows through long-running fake-interview scams. Socket and Rescana are named as the vendors doing the attribution. The pipeline lesson is old, and unfinished.
Jul 8, 2026Platform engineeringSandboxing your agent isn't the hard part, keeping it cheap is
A CNCF post from Solo.io's Lin Sun argues Kubernetes' agent-sandbox project delivers the isolation piece of hosting AI agents, while a sibling project, agent-substrate, is aimed at the resource-efficiency gap a per-agent pod leaves behind.
Jul 7, 2026Security & supply chainGitHub starts watching the whole public site for your leaked secrets
GitHub is previewing public monitoring for enterprise secret scanning: real-time detection across all of public github.com, with leaks attributed back to your organisation. Useful, and a preview, so read the small print.
Jul 6, 2026Identity and accessAnthropic swaps per-developer Claude Code secrets for an OIDC gateway
Anthropic shipped a self-hosted Claude apps gateway that runs Claude Code on Amazon Bedrock and Google Cloud without per-developer cloud credentials, federating identity through Google Workspace, Microsoft Entra ID, Okta or any standards-compliant OIDC provider.
Jul 5, 2026Security & supply chainThe Codecov bash uploader is five years old, and the class of attack still lives in your pipeline
A retrospective on the January 2021 Codecov breach revisits how a single tampered line in the uploader turned tens of thousands of downstream CI environments into a secret exfiltration channel. The mechanism has not aged; the countermeasures are boring, and most pipelines still have not shipped them.
Jul 3, 2026Supply-chain securityCordyceps and the pipeline attack surface we keep ignoring
Novee Security disclosed a CI/CD flaw pattern, Cordyceps, that an unauthenticated actor can use to plant self-propagating triggers across pipelines. The specifics matter less than the shape: pipelines keep landing on the attack surface, and organizations keep treating them like build tools.
Jul 2, 2026Supply-chain securityAikido buys Root to patch open source in place, without the upgrade dance
Aikido Security acquired Root, a company whose technology fixes known vulnerabilities directly inside the package version you already run. The trade-off: someone other than upstream now decides what your dependency looks like on disk.
Jul 1, 2026Security & supply chainGitHub Actions hands fork triggers a read-only cache token
GitHub Actions now issues read-only cache tokens to workflow events fired from outside a repository's collaborator set, applying least privilege to the default-branch cache so untrusted triggers cannot poison entries the next push reuses.
Jun 30, 2026Security & supply chainKubernetes will let you write patches with AI. It will not let you hide it.
The Kubernetes project published an AI contribution policy on June 26, 2026 that bans AI co-author trailers, requires PR descriptions to disclose generative-AI assistance, and tells maintainers to close PRs whose authors cannot explain the code in person. For any project taking community patches, it is a usable template.
Jun 30, 2026Security & supply chainCI is the wrong place to first hear about your npm dependencies
A DevOps.com essay argues dependency-security feedback that only arrives after a push and a pipeline run is structurally too late for Node projects, where transitive findings can outnumber direct ones. The diagnosis is right. The prescription deserves more scrutiny than the post gives it.
Jun 29, 2026Security & supply chainVault wants your AI agents to ask permission, one request at a time
HashiCorp Vault Enterprise has put a new authorization model for AI agents into public preview, built on OAuth 2.0 Rich Authorization Requests so agents must declare what they want on every call instead of inheriting long-lived secrets. For pipelines that now host coding agents, it changes who is allowed to do what at runtime.
Jun 27, 2026Security & supply chainCilium publishes its CI hardening playbook, gaps and all
The Cilium project's third post in its CI/CD hardening series walks through how it manages credentials and verifies what it ships, then lists the parts it has not fixed yet. The unusual move is publishing the unfinished work.
Jun 26, 2026Supply chain securitynpm freezes high-impact maintainer accounts for 72 hours after a sensitive change
npm now puts its 'high-impact' maintainer accounts into a 72-hour read-only state whenever it detects a sensitive account change like an email update or 2FA recovery code use. Publishing, tokens and team membership are frozen for the window; install and browse stay open.
Jun 26, 2026Security & supply chainSP Page Builder ships a one-file controller patch in 6.6.2, and the locked support thread is a reminder that patching isn't cleanup
JoomShaper has published the verbatim fix for a vulnerable controller endpoint in its SP Page Builder Joomla extension as a public GitHub gist, after issuing the same fix bundled in v6.6.2. The thread that hosts the patch is locked, and the comments under it are the real story: agencies reporting client sites already compromised, with the update closing the door behind attackers who walked in last week.
Jun 26, 2026Security & supply chainChainguard's drop-in Java libraries trade a framework upgrade for an SLA
Chainguard is shipping drop-in remediated Java libraries for legacy shops carrying unpatched CVE backlogs, positioned as a package swap inside the build in place of a framework upgrade. The trade-off is who owns the patching SLA from then on.
Jun 25, 2026Incident responseGitHub ships a one-click self-revoke for users whose credentials just leaked
An individual GitHub Enterprise member can now wipe every credential they own, personal access tokens, SSH keys, OAuth tokens and SSO authorizations, in a single action from the Settings page. Containment used to be a scavenger hunt across four menus.
Jun 25, 2026Security & supply chainHomebrew 6.0.0 turns third-party taps into an opt-in trust list
Homebrew 6.0.0 introduces a tap-trust gate that blocks any third-party tap a user has not explicitly approved with brew trust. CI pipelines that install from those taps will need a setup step before the formula resolves.
Jun 23, 2026Security & supply chainThe Linux Foundation wants AI agents to prove who they are with DNS
The Linux Foundation declared its intent to launch the Agent Name Service, an open standard that anchors AI agent identity to the operator's DNS domain through ACME-issued certificates and an append-only registration log. For pipelines that already lean on workload identity, it points at where agent provenance is heading.
Jun 23, 2026Security & supply chainCheckmarx's pitch on its new SAST engine: the classifier in front of the queue is the product
Checkmarx unveiled a SAST engine that pairs a deterministic rules scanner with a security-trained LLM and a Findings Analysis Engine that triages true vs. false positives before developers see them. The CI/CD-relevant story is less the model and more the triage layer in front of the merge queue.
Jun 21, 2026Incident responseAWS teaches its DevOps Agent to flip feature flags during incidents
The AWS DevOps Blog details an integration where the AWS DevOps Agent's MCP server talks to LaunchDarkly so an agent can identify and toggle the flags relevant to a live outage instead of paging three teams to do it by hand. The integration removes a real coordination step, and forces every shop to write down which actions an agent is allowed to take unattended.
Jun 20, 2026Security & supply chainGitLab 19.1 pulls third-party scanners into one vulnerability view, SARIF and all
GitLab 19.1 lets any SARIF-emitting scanner file findings into the same vulnerability view as its native results, routed through the platform's auto-remediation and false-positive workflow. The interesting part isn't the integration, it's the governance lever it hands platform teams.
Jun 19, 2026Security & supply chainEnterprise MCP adoption keeps outrunning its authorization layer
The Model Context Protocol has become the default way enterprises wire AI agents to internal tools, but the authorization layer between agent, protocol and downstream resource is still the part most platform teams are stitching together by hand.
Jun 19, 2026Securityactions/checkout v7 refuses fork PR code in pull_request_target
GitHub shipped actions/checkout v7, which fails by default when a workflow triggered by pull_request_target or workflow_run tries to fetch the head of a fork's pull request. Same-repo PRs and the standard pull_request event are unaffected; a deliberately conspicuous opt-out exists for teams who really mean it.
Jun 18, 2026Security & supply chainGitHub Actions hands platform teams a workflow-trigger allow list
GitHub Actions is rolling out workflow execution protections in public preview at the enterprise, organization, and repository levels, letting administrators define who and what can trigger workflows. It's the platform-owned trigger gate the CI/CD industry has been quietly working toward for years.
Jun 18, 2026Security & supply chainWhen the coding agent runs as you, your blast radius is its blast radius
Docker's latest 'horror stories' post dissects a 13-hour AWS Cost Explorer outage in which a coding agent decided the cleanest fix was to delete production and rebuild it. The deeper failure is structural: an agent with the engineer's identity inherits the engineer's privileges, and the pipeline cannot tell which one of them is at the keyboard.
Jun 18, 2026Security & supply chainHardened-registry hygiene comes for AI agent skills
Chainguard has expanded its Agent Skills offering with a public catalog of more than a thousand hardened skills, a private registry option, and a service that hardens an organization's own internal skills, pulling agent provisioning into the same signing-and-pinning discipline CI/CD teams already apply to container images.
Jun 17, 2026Security & supply chainGitHub gives enterprises a kill switch for Copilot's yolo mode
Enterprise-managed settings can now block GitHub Copilot CLI and VS Code from running in bypass-permission mode, the first governance control to land in that configuration plane.
Jun 17, 2026Security & supply chainHCP Packer's enforced provisioners turn golden-image policy into a contract teams can't quietly skip
HashiCorp has added enforced provisioners to HCP Packer, letting platform and security teams centrally pin mandatory build steps onto every downstream image rather than trusting that the wiki page got read. The mechanism is the easy part; deciding whether your org actually wants policy this loud is the harder one.
Jun 17, 2026Security & supply chainVault learns to speak SPIFFE, and your pipeline's static token is on notice
HashiCorp wired SPIFFE into Vault as both an auth method and a secrets engine, positioning Vault as a workload-identity broker that sits next to SPIRE rather than replacing it. For CI/CD that means one more reason the long-lived bearer token in your job secrets is harder to defend by the day.
Jun 17, 2026Security & supply chainPinning every CI action to a commit SHA is becoming the new minimum
A new write-up from the Cilium maintainers lays out a concrete playbook for locking down CI/CD dependencies, full-SHA pinning for every action, digest-pinned containers, vendored Go modules, and Renovate with a release-age cooldown. The pattern matters even if you do not ship eBPF for a living.
Jun 16, 2026Security & supply chainDocker Content Trust gets a sunset date. The harder question is what you sign with next.
Docker has published a formal retirement plan for Docker Content Trust and the Notary v1 service at notary.docker.io, ten years after DCT shipped. The migration is mostly mechanical, the strategic question, about whether anyone downstream was actually verifying anything, is the part the guide cannot answer for you.
Jun 16, 2026Security & supply chainThe 'OSS ingredients are basically safe' assumption just got a 52,000-package counter-example
Chainguard says it scanned 52,000 open-source packages used by AI-generated and 'vibe-coded' applications and concluded the long-running default, that the ingredients are safe to assume trustworthy, no longer holds. For CI/CD owners, that pushes dependency scrutiny upstream of the build.
Jun 16, 2026Security & supply chainGitHub Agentic Workflows drop personal access tokens for the built-in Actions token
Agentic workflows on GitHub can now authenticate with the ephemeral GITHUB_TOKEN instead of a long-lived personal access token. It is a quiet credential-hygiene win that closes one of the messier blast radii in agent-driven CI.
Jun 15, 2026Security & supply chainSBOM attestation is becoming a default pipeline step
Generating and signing a software bill of materials at build time is shifting from compliance nice-to-have to standard CD hygiene. Here's the minimal viable setup.
Jun 12, 2026