CI and CD are two different disciplines wearing one acronym. A practical guide to the merge gate that keeps main shippable, a real GitHub Actions pipeline with OIDC and caching, the deployment strategies that make releases boring, and the supply-chain gates that stop a poisoned build.
Supply-Chain
-
CI/CD Pipelines in 2026: The Merge Gate, the Deploy Strategy, and the Supply Chain -
Container Security in 2026: The Threat Model, the Supply Chain, and a Pod That Can't Hurt You Containers share a kernel, so a container is not a security boundary by default. This is the practical hardening that makes one act like a boundary — minimal pinned images, a signed and scanned supply chain, dropped capabilities and seccomp, and a Kubernetes securityContext that actually holds.
-
The OWASP Top 10 (2025 Edition): What Changed and How to Fix Each Risk The OWASP Top 10 was refreshed in 2025: two brand-new categories, a big promotion for misconfiguration, and SSRF folded into access control. A practical walk through all ten with vulnerable-versus-fixed code and the defenses that actually move the needle.
-
How Supply Chain Attacks Actually Work: The Anatomy of XZ, SolarWinds, and the npm Sagas Supply chain attacks do not break down the front door — they get invited in through the build systems, package registries, and maintainer trust that modern software runs on. A forensic walk through the XZ Utils backdoor, SUNBURST, and the npm registry attacks, the pattern they share, and the defenses that actually survive contact with real codebases.
-
Chip Export Controls: Why You Can't Buy an H100 in Shanghai How US export controls turned the AI compute supply chain into a theater of geopolitics: the TPP and performance-density thresholds, the A800/H800 workaround, ASML's EUV monopoly as the real chokepoint, China's domestic scramble, and why the rules keep flip-flopping under your feet.
-
Container Security in the Cloud: From Image to Runtime Supply chain hardening with Cosign and Syft, ECR scanning, Pod Security Standards, Falco runtime detection, network policies, External Secrets Operator, and admission controllers.
-
Deterministic and Reproducible Builds: Why Your Build Should Be a Pure Function Why builds should be reproducible, how to achieve hermetic builds with Bazel and Nix, SLSA build provenance, SOURCE_DATE_EPOCH, and how to verify binary equivalence with diffoscope.
-
Supply Chain Security: SBOMs, Sigstore, Cosign, and SLSA A practical guide to software supply chain security — generating SBOMs with Syft, signing artifacts with Cosign and Sigstore, verifying provenance with SLSA, and integrating these controls into your CI/CD pipeline.