Bypassing required reviews using GitHub Actions

Not using GitHub Actions? You’re also vulnerable.

PPE — Poisoned Pipeline Execution

Running malicious code in your CI, without access to your CI

NPM might be executing malicious code in your CI without your knowledge

Visualizing CI/CD from an attacker’s perspective

Exploiting Jenkins build authorization

Are you aware of the risks lurking in your default Jenkins…

Malicious code analysis: Abusing SAST (mis)configurations to hack CI systems

What happens when SAST…

Our dependencies are under attack, and this time we were lucky…

How can we protect ourselves when our…

Secret Diver — Searching for deeply hidden secrets

Optimizing your resilience against Log4Shell

Collection of actionable measures — across Prevention, Mitigation, Detection and…