DevSecOps
GitLab CI Security Scanning Setup
Step-by-step guide to enabling SAST, DAST, dependency scanning, and container scanning in GitLab CI pipelines.
Mar 22, 20236 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Step-by-step guide to enabling SAST, DAST, dependency scanning, and container scanning in GitLab CI pipelines.
Everyone talks about security debt. Almost nobody measures it. Here are practical methods for putting numbers on the security shortcuts your organization has accumulated.
AI code assistants are writing a growing share of production code. The security implications are significant and largely unaddressed.
Modern applications use multiple languages and package ecosystems. Analyzing dependencies across these boundaries requires techniques that single-ecosystem tools cannot provide.
Go checksum database is one of the most underappreciated supply chain security features in any language ecosystem. Here is how it works and where it falls short.
Security isn't just the security team's problem. Building effective collaboration between security, engineering, product, and operations is essential for supply chain defense.
DAST finds what source code analysis cannot. Here is how to set it up, tune it, and actually get value from it in a modern CI/CD pipeline.
Brakeman understands Rails conventions and catches security issues that generic scanners miss. Here is how to use it effectively.
EPSS offers a data-driven approach to vulnerability prioritization. Learn how it works, how it compares to CVSS, and why your team should care.
Weekly insights on software supply chain security, delivered to your inbox.