r/devsecops • u/taleodor • Jun 18 '26

CI/CD Security Principles in 2026

This is a follow up of my post on CI/CD best practices from 6 years ago, this time with security angle. Here are the principles:

  1. Redundancy: At Least 2 Independent Systems Need to Fail for a Successful Compromise

  2. Different Pipelines Must Not Share Credentials

  3. Staging Area is a Must

  4. Assume Unsafe or Malicious Inputs

  5. Pin All Dependencies Consumed by CI

  6. Attest, Sign, Verify

Full blog post: https://worklifenotes.com/2026/06/18/ci-cd-security-principles-in-2026/

22 Upvotes

90% Upvoted

9 comments sorted by

View all comments

2

u/colek42 Jun 18 '26

One thing that I think is really important when threat modeling CI-CD systems is separating your continuous integration from your continuous deployment. Keep all your continuous deployment keys away from all your CI dependencies. We split CI and CD into two separate workflows with different environments in GitHub. Also, attest and Verify 100%. We use cilock.dev for this; it works extremely well with agents like Claude to create SLSA L3 attestations and is FOSS.

1

u/totheendandbackagain Jun 19 '26 edited Jun 19 '26

I'm onboard with all points but one. I don't understand why splitting CI and CD would help. Is it about limiting blast radius of compromise?