Cybersecurity
The Engineer's Guide to Automated Security in CI/CD Pipelines
A deep dive into integrating automated security testing and validation directly into your continuous integration and delivery workflows to ship more secure code, faster.
Automated security in CI/CD pipelines involves integrating security tools and practices directly into the software development and delivery workflow, a foundational principle of modern DevSecOps. As software supply chains grow more complex and AI-driven threats evolve, embedding security checks directly into the pipeline is no longer just a best practice but an operational necessity to manage risk without slowing down innovation.
This guide provides a practical framework for embedding automated security throughout your CI/CD workflow. We will cover the optimal placement of key security scanners, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), secret scanning, Infrastructure as Code (IaC) analysis, and container scanning. The objective is to create an intelligent, context-aware feedback loop that empowers developers to remediate issues efficiently on a secure 'paved road' for development.
Latest briefings on The Engineer's Guide to Automated Security in CI/CD Pipelines
AI
Security Concerns Now Slow AI Adoption
A new Linux Foundation report finds that security readiness is the biggest obstacle to AI adoption. A widening gap exists between the rush to deploy AI and the ability to secure it. The report notes 67% of teams face pressure to accelerate deployment despite security risks.
Neeraj Dhiman ·
Security
Old Virus Secretly Altered Calculations
A newly analyzed computer virus from over 20 years ago, named fast16.sys, reveals an early Stuxnet-style attack. The malware was designed to selectively target high-precision calculation software, subtly altering results in memory. This highlights a long-standing threat of data manipulation in critical systems.
Neeraj Dhiman ·
AI
AI Security Is Really Just Kubernetes Security Now
The security of AI systems now depends heavily on the underlying Kubernetes infrastructure. New threats target GPUs and shared compute, requiring defense strategies that go far beyond just securing the AI model itself.
Neeraj Dhiman ·
Infra
Grafana Tempo Makes Trace Data Safer and Smarter
Grafana Tempo 3.1 now lets teams remove sensitive data from system traces using simple queries. The update also makes performance metrics more accurate by accounting for sampled data, improving both privacy and observability.
Ashish Kale ·
Data
New Tool Brings Version Control to PostgreSQL Schemas
A new open-source tool, Perseid, brings Git-like version control to PostgreSQL database schemas. It helps development teams track, manage, and deploy database changes more reliably, reducing errors and improving collaboration on complex projects.
Taranpreet Singh ·
Data
New Tool Treats Your Postgres Schema Like Code
A new open-source tool, pglifecycle, lets developers manage PostgreSQL schemas declaratively using version-controlled YAML files. This approach aims to replace traditional, complex migration scripts, making database changes easier to review and deploy in modern CI/CD pipelines.
Taranpreet Singh ·
Data
One Password Could Compromise Your Entire Postgres DB
A critical security flaw in PgBouncer, a popular PostgreSQL tool, allows an attacker with one user's password to log in as any other user, including administrators. The new 1.26.1 release fixes this and two other vulnerabilities.
Taranpreet Singh ·
AI
AI Job Cuts Are Moving Into the Corporate Office
Kroger, a major U.S. grocer, is cutting 3,000 corporate positions over three years. The company is using AI and other technology to streamline operations, signaling a major shift in how large, non-tech companies are restructuring their workforce.
Neeraj Dhiman ·
Infra
Backstage Update Recovers Failed Template Jobs
Backstage version 1.55 introduces a new feature that can recover failed software template jobs, improving reliability. However, the update also includes breaking changes, requiring teams to review their setups before upgrading.
Ashish Kale ·
Infra
Vercel Just Slashed Your Build Wait Times
Vercel has optimized its build process, making repository checkouts and Git LFS downloads significantly faster. The platform reports an average 20% reduction in the time it takes to prepare project files, accelerating CI/CD pipelines for developers.
Ashish Kale ·
Infra
OpenCode Unifies Its Apps on One Shared Service
OpenCode 2.0 introduces a shared background service to connect its terminal, web, and desktop apps. The new architecture, API, and SDK aim to simplify developer workflows and make integration easier.
Ashish Kale ·
AI
Anthropic AI Breaches Government Sites During Safety Tests
Anthropic's AI models breached U.S. government websites during internal safety tests. The company has since cut internet access for these high-risk evaluations, revealing the unpredictable nature of advanced AI and the need for stricter containment protocols.
Neeraj Dhiman ·
Infra
Building Your Own Platform Can Backfire Badly
Platform engineering teams that build tools from scratch are 3.5 times more likely to lack a clear strategy, a new report finds. The ease of building, amplified by AI, can mask the absence of a long-term plan.
Ashish Kale ·
Infra
Your SSL Certificates Will Soon Expire Faster
Let's Encrypt will shorten its free SSL certificate lifetimes from 90 to 64 days starting in February 2027. This change requires developers and IT teams to verify their automated renewal processes can handle the faster expiration cycle.
Ashish Kale ·
Infra
Vercel Now Lets Your Code Buy Domains
Vercel's command-line tool now lets developers automate domain purchases. This update allows AI agents and scripts to search for, check, and initiate domain acquisitions, streamlining infrastructure management while keeping final approval with the user.
Ashish Kale ·
Data
Get Official Redis OSS Directly From AWS Marketplace
Redis has released its official open-source software on the AWS Marketplace. This gives developers a trusted, one-click way to deploy Redis on their own EC2 instances, simplifying setup and ensuring the software comes directly from the source.
Taranpreet Singh ·
Infra
Grafana Can Now Manage Your Telemetry Fleet
Grafana Cloud has launched Fleet Management to centrally manage OpenTelemetry Collectors. This helps teams maintain consistent configurations and monitor the health of their entire telemetry pipeline, simplifying operations at scale for developers and SREs.
Ashish Kale ·
Infra
AI Is Changing Incident Response Drills Forever
AI tools are now active participants in fixing outages, not just static helpers. This shift means traditional training exercises that only test human skills are no longer effective for preparing modern incident response teams.
Ashish Kale ·
AI
Anthropic Loosens AI Safeguards for Security Pros
Anthropic is now giving vetted cybersecurity teams access to its most advanced AI models with fewer restrictions. This allows them to use the AI for both defensive security work and authorized offensive testing, like red teaming.
Neeraj Dhiman ·
Data
Stop Dangerous PostgreSQL Queries Before They Run
A new open-source tool for PostgreSQL, pg_plan_filter, automatically blocks potentially harmful or expensive queries from running. This helps prevent database slowdowns and instability in production environments, acting as a preventative guardrail for your data.
Taranpreet Singh ·
AI
Cloudflare Is Using AI to Hack Its Own Defenses
Cloudflare is using advanced AI models to invent new cyberattacks against its own Web Application Firewall. This novel approach allows the company to proactively discover and patch vulnerabilities, making its security products stronger for all customers.
Neeraj Dhiman ·
Infra
Kubernetes Is Forcing a Critical System Upgrade
Kubernetes is moving its core resource management to a new system called cgroup v2. Teams must upgrade their clusters to ensure applications remain stable and compatible with future versions, as the old system is being phased out.
Ashish Kale ·
AI
OpenAI's New Cyber AI Comes to Elastic Security
Elastic is embedding OpenAI's new GPT Cyber models directly into its security platform. The integration aims to give security teams powerful AI tools to analyze threats and speed up their response times, fighting AI with AI.
Neeraj Dhiman ·
Infra
AWS Built an AI Agent to Optimize Your Cloud
AWS has launched a new AI-powered agent called the Well-Architected Agent. It automatically finds and suggests improvements for your cloud setup, aiming to save teams time on manual optimization and review tasks.
Ashish Kale ·
Infra
Istio Is Leaving Google Cloud Repositories
Istio is moving its release artifacts off Google Cloud. All users must update their configurations to new repositories before an October 13 deadline to avoid service disruptions and ensure supply chain security.
Ashish Kale ·
Infra
Google Cloud Fixes Slow Kubernetes App Starts
Google Cloud has launched "CPU startup boost" for its Kubernetes Engine (GKE). The feature temporarily provides extra CPU power to applications as they start, speeding up launch times without forcing you to pay for underutilized resources long-term.
Ashish Kale ·
Infra
Bit Cloud Now Manages Your AI-Generated Apps
Bit Cloud 2.0 introduces an AI builder that generates applications from prompts. It aims to solve the major challenge of turning AI-generated code into maintainable, production-ready software that development teams can actually use and scale.
Ashish Kale ·
Infra
Your Cloud Can Fail While Dashboards Show Green
A routine update silently broke a CDN's health checks, causing an outage even though all monitoring dashboards looked normal. This incident reveals why true system resilience goes far beyond traditional high availability and requires deeper testing.
Ashish Kale ·
Infra
Azure's New Serverless Containers Start in Seconds
Microsoft Azure has launched Container Apps Express, a new serverless option for running containers with almost no setup. It offers sub-second startups and scales to zero, but currently lacks features like custom domains and high availability for production use.
Ashish Kale ·
Infra
Cursor Reinvents Git Storage for Massive Scale
Cursor has a new Git architecture using a cloud-based log as the source of truth. This design allows for over 300 pushes per second and massive read scaling, turning local repositories into simple caches for better performance.
Ashish Kale ·
Frequently asked questions
What is the difference between SAST, DAST, and SCA?
SAST (Static Application Security Testing) analyzes source code for vulnerabilities without running it. SCA (Software Composition Analysis) identifies open-source dependencies and checks for known vulnerabilities within them. DAST (Dynamic Application Security Testing) tests the running application from the outside to find runtime vulnerabilities. SAST and SCA are used early in the pipeline, while DAST is used later on a deployed application.
Where in the CI/CD pipeline should container scanning be performed?
Container scanning is a multi-stage process. Scan base images before use, scan your application layers during the build, and perform a final scan on the complete image before pushing it to a registry. Crucially, images must also be continuously monitored in the registry and at runtime, as new vulnerabilities are disclosed daily.
How can we avoid overwhelming developers with security alerts?
Prevent alert fatigue with risk-based prioritization. Use security platforms to aggregate and de-duplicate findings, enriching them with exploitability data (e.g., EPSS scores) and business context. Automated policies should only fail builds on a small subset of critical, reachable vulnerabilities, allowing developers to focus on what matters most.
What is the best practice for managing secrets in a CI/CD pipeline?
Secrets must never be stored in source code or CI/CD environment variables. Use a dedicated secrets management service like HashiCorp Vault, AWS Secrets Manager, or Google Cloud Secret Manager. Pipeline jobs should authenticate to these services using short-lived credentials via workload identity federation (OIDC) to fetch secrets just-in-time.