Pipeline & Supply Chain Security

Security work usually arrives as a report: a list of findings, a deadline, and a team that has to retrofit fixes into a pipeline that was never built to accommodate them. The alternative is to put the controls in the path the code already takes, where they cost minutes rather than sprints.

Code and dependency scanning

Static analysis with SonarQube integrated into pull requests, so findings appear where the review already happens. The important decision is not which scanner — it is which findings block a merge and which are advisory. Gate everything and the team routes around it within a fortnight; gate nothing and you have a dashboard nobody opens.

Dependency scanning matters more than most application findings. The realistic breach path in a modern stack is a compromised package, not a novel bug in your own code.

Artifact management

A registry such as JFrog Artifactory turns build output into something governed rather than something that happens. What we set up:

• Every artifact traceable to the commit and pipeline run that produced it
• Image scanning before promotion, not after deployment
• Retention and promotion policies, so production pulls from a curated repository rather than from wherever the build landed
• Proxied upstream repositories, so a public registry outage does not stop your builds

Secrets

Credentials in repositories and long-lived CI variables are the most common finding and the easiest to fix badly. The work is moving to short-lived, scoped credentials — OIDC federation between your CI and your cloud provider where possible, so pipelines assume a role instead of holding a key. Then rotating what genuinely has to persist.

Kubernetes hardening

Cluster security is mostly about defaults nobody changed:

• RBAC scoped to workloads rather than broad cluster roles
• Network policies that actually restrict traffic, instead of a default-allow mesh
• Pod security standards enforced by admission control
• Images pinned by digest and scanned in the pipeline
• Service accounts without tokens they do not use

What you get

Scanning and policy enforcement running inside the pipeline, an artifact repository with provenance and promotion rules, secrets handled through short-lived credentials, and a cluster configuration that reflects a deliberate security posture rather than installation defaults. Plus a written record of what was changed and why — the document that answers a client security review without a scramble.

On compliance

If the driver is ISO 27001, SOC 2 or a client security questionnaire, say so early. It changes what evidence needs to exist alongside the controls, and producing that evidence afterwards costs considerably more than generating it as you go.