detection engineering advanced
Your CI/CD Pipeline Is an Unmonitored Production Environment
XZ, tj-actions, Shai-Hulud, Codecov all owned the build, not the code. Scanning is blind to a poisoned build in flight. Detect the runner instead.
· 16 min read
#supply-chain
#ci-cd
#sigma
#detection-program