Supply Chain Security 101
Everything you need to know about software supply chain security in the age of open source.
- DevSecOpsSoftware Supply Chain
Vulnerability management for the modern engineering team
Learn how vulnerability management works, which CVEs need a deadline under CISA BOD 26-04, and why most can be fixed at your next image rebuild.
- DevSecOpsSoftware Supply Chain
CI/CD security best practices: 7 controls and how to test them
Pin actions, scope tokens, isolate runners, and verify artifacts. Seven CI/CD security best practices, each with a check to confirm it blocks what it should.
- DevSecOps
How to scale DevSecOps automation with shared workflows
A merged update PR isn’t a fix in production. Decide which DevSecOps automation to share, who owns each part, and how to pilot it before adding teams.
- DevSecOps
MCP security: How to evaluate an MCP server before rollout
A legitimate MCP server can still return malicious instructions. This MCP security guide shows how to scope its access and test what an assistant can send.
- DevSecOpsSoftware Supply Chain
What is a build horizon?
A build horizon sets a maximum age for software artifacts. Learn why it stops CVE buildup and how to enforce it with automated updates, rebuilds, and policy.
- DevSecOpsSoftware Supply Chain
SBOMs vs. attestations: What's the difference?
An SBOM lists what's in your software, and an attestation proves who built it and how. Learn the difference and when to use cosign attest vs. cosign attach.
- Software Supply ChainDevSecOps
What is Octo STS? Overview and FAQ
Octo STS replaces long-lived GitHub personal access tokens with short-lived, OIDC-federated tokens. Learn how it works, trust policies, and common use cases.
- Tools & Buyer’s GuidesDevSecOps
GitHub Actions alternatives: 8 ways to replace or secure unvetted actions
Compare 8 alternatives to unvetted GitHub Actions, including hardened drop-in replacements, SHA pinning, GitLab, CircleCI, and Buildkite, for secure CI/CD.
- Software Supply ChainDevSecOps
npm supply chain attacks: How to audit your dependency controls
Reduce the risk of npm supply chain attacks. Trace a package’s path into your build, verify its artifact, and control what can execute.
- Software Supply ChainDevSecOps
What is dependency confusion? How to reduce the risk of attack
Dependency confusion tricks a build into installing a malicious public package instead of a private one. Learn the controls that reduce the risk.
- DevSecOpsSoftware Supply Chain
CI/CD security: A practical guide to trusted pipelines
Secure CI/CD pipelines from dependency confusion, tag hijacking, and secret leaks. Learn key controls like pinned actions and build provenance.
- Software Supply ChainDevSecOps
What is container runtime security?
Understanding container runtime security best practices can help protect your critical applications against threats to your containerized applications.