October 26, 2026
Give alert triage its own token permissions
A dedicated GitHub Actions workflow can read Dependabot alerts without inheriting the broader permissions used to build, publish, or deploy software.
Read article
Posts tagged “security”.
One tag at a time. The full list is on the articles page.
October 26, 2026
Treat workflow changes as governed releases
I explain how to inventory workflow changes across repositories, require trusted review, and keep credentials out of untrusted workflow runs.
Read article
October 26, 2026
Give workflows an access model before secrets get finer-grained
A purpose-based access model helps teams reduce GitHub Actions secret exposure now and adopt finer-grained controls without confusing configuration for policy.
Read article
October 19, 2026
Test Claude Code hooks as behavior contracts
I explain why natural-language hooks need adversarial regression tests and where deterministic controls must enforce policy outside the agent.
Read article
October 19, 2026
Plan GitHub Actions investigations around evidence
I explain how to define the evidence, retention and access an incident investigation needs before relying on GitHub Actions Data Stream.
Read article
October 13, 2026
Treat GitHub Actions cache reuse as a trust boundary
A cache can expose data to readers or let an untrusted workflow influence a trusted build, so I make cache access part of pipeline security design.
Read article
October 13, 2026
CI egress policy should follow workflow trust
Runner identity is not enough to decide what a CI job may contact; I explain how to map dependencies and separate policy by job purpose.
Read article
October 13, 2026
Audit who owns your Kubernetes service IPs
An ownership-first audit of Services using externalIPs helps you choose a safe migration path before Kubernetes removes that behavior.
Read article
October 13, 2026
Execution policy belongs outside the workflow
GitHub Actions execution protections can block disallowed runs before workflow code starts, but they cannot make trusted workflow code safe.
Read article
October 13, 2026
A workflow security incident needs a recovery design
A recovery-ready CI architecture maps compromised actions to repositories and credentials, then restores safe shipping without reopening the same blast radius.
Read article
October 8, 2026
Test Kubernetes security defaults at the workload level
I explain how to test Kubernetes v1.36 security behavior against real workloads and make the intended posture explicit before upgrading.
Read article
October 6, 2026
Managed coding agents change the control-plane question
A practical way to compare managed coding agents with agents running in your own environment is to trace who controls access, execution and evidence.
Read article
October 6, 2026
Ingress controller retirement is an architecture migration
A practical way to replace a retired ingress controller is to map the edge responsibilities first, then preserve the external-to-internal contract deliberately.
Read article
October 5, 2026
Kubernetes Pod user namespaces are worth piloting
I explain how Pod user namespaces change the host-side impact of a container escape, what they do not replace, and what I would test before relying on them.
Read article
October 4, 2026
What Claude Code auto mode can decide—and what I would gate
I explain where Claude Code auto mode can reduce approval friction, and which actions I would still keep behind explicit human approval.
Read article
October 2, 2026
Make secret access explicit in reusable workflows
Learn how scoped secrets could change reusable workflow contracts, and how to roll out explicit access and verify it with execution telemetry.
Read article