DevSecOps: put useful security controls into CI/CD

Adding scanners to a pipeline does not secure software by itself. If every finding blocks without context, teams learn to bypass the control. If nothing blocks, the dashboard becomes an archive.

The NIST Secure Software Development Framework covers preparation, software protection, secure production and vulnerability response. CI/CD is one part of that system, not its only defence.

Define the decisions

Write rules before selecting tools: protected branches, required reviews, blocking findings and who can accept a risk. Every exception needs an owner, rationale and review date. An exploitable flaw in an exposed component is different from an uncertain result in code that is not shipped.

Add progressive controls

Before push, detect secrets and run fast checks. On the pull request, run tests, static analysis and dependency review. GitHub's dependency review compares changes and can enforce a chosen policy before a vulnerable dependency is merged.

After the build, inspect the deployable artefact: image, packages, configuration and infrastructure as code. Retain the identity of its source, commit and build process. The SLSA specification provides a vocabulary for artefact integrity and provenance; choose guarantees that match the threat.

Before production, check permissions, secrets, network exposure and deployment policy. After release, monitor new disclosures and be ready to rotate credentials or retire components.

Reduce noise and protect the pipeline

Route findings to owners, remove duplicates and separate discovery from validation and remediation. Track time to fix, expired exceptions and controls people repeatedly bypass. Start with secrets, newly introduced dependencies, confirmed critical defects and pipeline protection.

A pipeline can access source, tokens and production. Minimise runner permissions, isolate environments and control third-party actions or images. A good scanner in a workflow anyone can alter does not provide the intended assurance.

The goal is a clear decision at the right time, with a practical route to remediation and a record when risk is accepted.

Official sources

• NIST SP 800-218, February 2022.
• Dependency review, GitHub, accessed 7 September 2026.
• SLSA v1.2, accessed 7 September 2026.