CI/CD: every stage carries a trust boundary
Building code and authorizing production are different decisions.
DevSecOps and SSDLC
Security in development, pipelines, dependencies and vulnerability management.
Reading on this topic
SBOM: from component list to response decision
Inventory must connect to running software.
GitHub Actions: who can change the build tool?
Pipeline dependencies deserve code-level scrutiny.
Infrastructure as code: return manual exceptions to the workflow
Repositories represent environments only when differences are reconciled.
Secrets: emergency rotation must work under pressure
Central storage does not replace rehearsed revocation.
Code review: prioritize trust-changing modifications
Diff size does not measure security impact.
Supply chain: release the artifact that was assessed
Rebuilding at the last step can change the trust unit.
Vulnerabilities: prioritize the affected-system decision
Component severity is an input, not the whole context.
Thiago Lima Soneti da Silva (Thiago Silva) — Cyber Architect and technical lead at Lima e Silva Tecnologia.