GitHub Actions security checklist for release pipelines
Review workflow triggers, token permissions, third-party actions, untrusted inputs, runners, environments, OIDC, and release artifacts in GitHub Actions.
Read the guideSupply chain & AI · 8 guides
Secure dependencies, agents, and AI features
Guides to software provenance, build trust, AI permissions, retrieval boundaries, and the risks introduced by connected tools and third-party packages.
LLM prompt injection defense: protect the action boundary
Review prompt injection risks across untrusted content, tool permissions, retrieval, approvals, and output handling with practical tests for AI applications.
Read the guideLockfile integrity: reproducible dependencies and security limits
Review lockfiles, dependency diffs, integrity metadata, installation scripts, and build reproducibility while understanding what a lockfile cannot guarantee.
Read the guideMCP server security checklist: identity, tools, and data
Review MCP server security across token audience, authorization, connected-tool permissions, discovery URLs, secrets, and approval of consequential actions.
Read the guidenpm supply chain attack response: from package to environment
Respond to an npm package compromise by tracing installation, execution, credentials, artifacts, and clean recovery, with a practical evidence-first checklist.
Read the guideRAG application security: retrieval must respect data access
Review retrieval-augmented generation across document ownership, indexing, tenant filters, context assembly, citations, caches, and data deletion workflows.
Read the guideSAST vs DAST vs SCA: choose useful security coverage
Compare static code analysis, dynamic application testing, and dependency analysis, then combine their evidence with manual review of business and access rules.
Read the guideSBOM and dependency inventory: make advisories actionable
Build a useful software dependency inventory and SBOM, connect packages to deployed releases, and turn a new advisory into a traceable exposure decision.
Read the guide