Cybersecurity
The Engineer's Guide to Automated Security in CI/CD Pipelines
A deep dive into integrating automated security testing and validation directly into your continuous integration and delivery workflows to ship more secure code, faster.
The 'shift-left' security model, which integrates security practices early in the development lifecycle, is no longer a niche concept but a necessity for modern engineering teams. Addressing vulnerabilities in production is exponentially more costly and risky than catching them in development. As development velocity increases with CI/CD, security processes must automate and scale in lockstep, transforming from a final-stage gatekeeper to a continuous, integrated part of the pipeline.
This guide provides a practical framework for embedding automated security tooling throughout your CI/CD workflow. We will explore the roles and optimal placement of key security scanners, including Static Application Security Testing (SAST) for source code, Software Composition Analysis (SCA) for dependencies, secret scanning, and container image analysis. The goal is to create a robust, automated security feedback loop that empowers developers to identify and remediate issues quickly, without sacrificing speed.
Latest briefings on The Engineer's Guide to Automated Security in CI/CD Pipelines
AI
Security Concerns Now Slow AI Adoption
A new Linux Foundation report finds that security readiness is the biggest obstacle to AI adoption. A widening gap exists between the rush to deploy AI and the ability to secure it. The report notes 67% of teams face pressure to accelerate deployment despite security risks.
Neeraj Dhiman ·
Security
Old Virus Secretly Altered Calculations
A newly analyzed computer virus from over 20 years ago, named fast16.sys, reveals an early Stuxnet-style attack. The malware was designed to selectively target high-precision calculation software, subtly altering results in memory. This highlights a long-standing threat of data manipulation in critical systems.
Neeraj Dhiman ·
Infra
New AWS Agent Finds and Fixes Cloud Overspending
AWS has launched a new managed service called FinOps Agent. It automatically investigates cost spikes, finds the cause, and sends alerts to the right teams through tools like Slack and Jira to help control cloud spending.
Ashish Kale ·
AI
A Normal-Looking Image Can Jailbreak AI Models
Researchers found a way to jailbreak vision-language AI models using tiny, invisible changes to images. This new attack method bypasses standard safety filters that only analyze text prompts, creating a significant new security risk.
Neeraj Dhiman ·
AI
How an Engineer Used AI to Find Security Flaws
A software engineer used GitHub Copilot, Claude, and Gemini to find security vulnerabilities in the ClickHouse codebase. This practical case study shows how AI can help developers without deep security expertise improve software security.
Neeraj Dhiman ·
Infra
Argo CD Now Verifies Your Code’s Origin
The popular cloud deployment tool Argo CD is getting a major security boost. Its latest update adds features to verify that your code is authentic and to encrypt internal traffic, helping to secure your software supply chain.
Ashish Kale ·
Infra
Get a Clearer View of Your Kubernetes AI Jobs
A new plugin for the Headlamp Kubernetes UI now supports Volcano, a popular batch scheduler for AI and high-performance computing. This gives developers a simple web interface to inspect and manage complex batch jobs directly within Kubernetes.
Ashish Kale ·
Infra
Secure Remote Access Just Got a Replay Button
HashiCorp's Boundary 1.0 is now production-ready, adding a key feature: RDP session recording. This helps security and IT teams monitor remote desktop access and meet strict compliance and audit requirements.
Ashish Kale ·
Infra
Cloudflare Tool Migrates Security Setups in Hours
Cloudflare has released a new open-source tool to help companies move to its Zero Trust security platform. It includes automated logic to migrate from competitors like Zscaler and Palo Alto Networks, cutting migration times from months to hours.
Ashish Kale ·
Data
Keep Your Old PostgreSQL Database Secure for Longer
A new service from PGX offers security patches and bug fixes for old, unsupported versions of PostgreSQL. This helps companies that can't upgrade stay secure and maintain data integrity without a costly migration.
Taranpreet Singh ·
Infra
Cloudflare Replaces API Tokens with Secure Logins
Cloudflare now lets all developers use OAuth for third-party app integrations. This offers a more secure alternative to traditional API tokens, giving users granular control over what data and actions an application can access.
Ashish Kale ·
Tech
Ukraine Open-Sources Captured Russian Military Technology
Ukraine's Ministry of Defence has launched TrophyLab, a new platform open-sourcing intelligence on captured Russian military hardware. Verified allies can access technical data, schematics, and even request physical samples to develop countermeasures.
Taranpreet Singh ·
Infra
AI Is Turning Developers Into Code Validators
A new GitLab report finds AI code tools are turning developers into validators, not just writers. This shift creates new risks, as teams struggle to control the quality and security of code they didn't write.
Ashish Kale ·
Infra
Find and Fix Workflow Bugs Faster on Vercel
Vercel has launched a redesigned trace viewer for its Workflows tool. The update helps developers debug complex processes more quickly by making it easier to search, zoom, and inspect each step of a workflow run.
Ashish Kale ·
Infra
Why Azure Says Stop Blaming People for Outages
A post-mortem of Azure's 2023 global outage reveals a crucial lesson: "human error" is a myth. Engineering leaders should instead focus on fixing systemic flaws to build truly resilient systems and protect their teams from blame.
Ashish Kale ·
Infra
Vercel Wants to Replace Your Feature Flag Tool
Vercel has launched its own feature flagging tool, built directly into its platform. This gives developers a native way to safely roll out new features and test changes, potentially replacing third-party services like LaunchDarkly.
Ashish Kale ·
Infra
Vercel Now Lets You Build Real-Time Apps
Vercel now supports WebSockets in its serverless functions, a long-requested feature. This allows developers to build real-time applications like live chats and collaborative tools directly on the platform, paying only for active processing time.
Ashish Kale ·
AI
Rust Hires an AI Expert to Fight Security Spam
The Rust Foundation has hired an AI Security Engineer in Residence. The new role will help manage the growing number of vulnerability reports generated by AI tools, allowing maintainers to focus on legitimate security threats.
Neeraj Dhiman ·
AI
This AI Finds Security Flaws Others Refuse To
A new AI model is designed specifically for security testing, unlike major models that refuse such tasks. It helps smaller companies find and fix vulnerabilities that might otherwise be missed, leveling the playing field against attackers.
Neeraj Dhiman ·
Infra
Keep Your Users Logged In During AWS Outages
Amazon Cognito now automatically copies user data to a backup region. This means if one AWS region fails, your application can still authenticate users from another, improving reliability and simplifying disaster recovery for developers.
Ashish Kale ·
Infra
Amazon ECS Now Scales Your Apps Much Faster
Amazon ECS can now adjust application capacity much faster, thanks to new high-resolution metrics. This allows services to react to traffic spikes in seconds instead of minutes, improving performance and potentially lowering cloud costs.
Ashish Kale ·
AI
GitLab Unlocks AI Adoption With New Security Tools
GitLab's latest update introduces event-driven triggers for its AI workflows. This helps companies automate tasks safely by giving security and IT teams better control and visibility over what AI tools are running in their environment.
Neeraj Dhiman ·
Infra
GitHub Is Helping Maintainers Reduce Project Noise
GitHub now lets open-source maintainers limit pull requests from new contributors. This helps them manage high volumes of submissions and focus on quality contributions instead of getting bogged down by spam or low-effort changes.
Ashish Kale ·
Infra
Getting Kubernetes Certified Just Became Much Simpler
The CNCF, Linux Foundation, and Udemy have partnered to offer a unified training and certification path. This makes it much easier for developers to purchase courses and sit for official Kubernetes exams like CKA, CKAD, and CKS.
Ashish Kale ·
AI
DeepMind Borrows Cybersecurity Playbook for AI Control
Google DeepMind released a new AI control roadmap that treats AI risks like cybersecurity threats. The framework uses familiar concepts like threat modeling to help developers build guardrails for increasingly powerful AI agents.
Neeraj Dhiman ·
Data
Build Elastic Integrations Faster, With or Without Code
Elastic 9.4 now offers two ways to build custom integrations. A new no-code tool makes it faster for anyone, while a developer toolkit provides full control for complex needs, simplifying data ingestion from any source.
Taranpreet Singh ·
Tech
Talk Your System Designs Into Existence
A new tool called VoiceDraw automatically creates system design diagrams from your spoken words. It aims to make technical discussions and interviews easier by letting you focus on thinking out loud instead of drawing by hand.
Navdeep Kaur Mahal ·
Infra
Vercel Unlocks 24-Hour Sessions for Developers
Vercel now allows its Sandboxes to run for up to 24 hours, a major increase from the previous five-hour limit. This change helps developers run complex, long-running tasks like large data processing and extensive testing.
Ashish Kale ·
Infra
Docker Retires Its Original Image Signing Tool
Docker is retiring its original Content Trust (DCT) feature and the Notary v1 service. This change requires developers and security teams to migrate to modern tools to continue verifying the integrity and publisher of their container images.
Ashish Kale ·
Infra
Key Java Frameworks Get Major Summer Updates
The Java ecosystem saw a wave of updates, including progress on Jakarta EE 12 and new releases for GraalVM, Gradle, and Micrometer. These changes bring stability, new features, and performance improvements for developers.
Ashish Kale ·
Frequently asked questions
What is the difference between SAST, DAST, and SCA?
SAST (Static Application Security Testing) analyzes source code or binaries for vulnerabilities without executing the code, making it fast for early feedback. SCA (Software Composition Analysis) specifically identifies open-source components and their dependencies, checking them against databases of known vulnerabilities. DAST (Dynamic Application Security Testing) tests the running application from the outside, simulating attacks to find vulnerabilities that only appear at runtime.
Where in the CI/CD pipeline should container scanning be performed?
Container scanning should occur at multiple points for comprehensive coverage. Scan the base image before use to ensure a secure foundation. Scan the final application image after it's built but before pushing it to a registry to catch vulnerabilities in added layers and dependencies. Finally, continuously monitor images in the registry and in production, as new vulnerabilities are disclosed daily.
How can we avoid overwhelming developers with security alerts?
Focus on high-fidelity, actionable alerts by tuning tools to reduce false positives and using a platform to aggregate and de-duplicate findings. Prioritize alerts based on context, such as vulnerability severity (e.g., CVSS score), exploitability, and the business criticality of the application. Set clear policies to automatically fail builds only on the most critical issues, creating tickets for the rest.
What is the best practice for managing secrets in a CI/CD pipeline?
Never store secrets like API keys or passwords directly in source code, configuration files, or as plain-text environment variables in the CI system. Use a dedicated secrets management service like HashiCorp Vault or AWS Secrets Manager. The pipeline should authenticate to this service using a short-lived, scoped identity to retrieve secrets just-in-time for the build or deployment steps.