Learn about CI/CD compliance, DevOps best practices, and governance guides to secure your pipelines.

Introducing Plumber 1.3: a more resilient analysis process, sensitive data redaction in logs, and various improvements

Libération: Bringing Clarity and Standardization to CI/CD Pipelines

Numspot: Building a Sovereign Cloud with Secure & Compliant CI/CD by Design

FDI Access: Proving CI/CD Compliance for VIGIK+ and ISO 27001

A step-by-step guide to adding SLSA provenance, OpenSSF Scorecard, SHA-pinned actions, least-privilege tokens, and more to your open-source project.

Checklist and controls for audit-ready CI/CD compliance (ISO 27001, NIS2, DORA, CRA). Examples, evidence, drift detection, and remediation at scale.

Introducing Plumber 1.1: portfolio compliance details, and various improvements

How we added SLSA Level 3 provenance, OpenSSF Scorecard monitoring, and OpenSSF Best Practices to Plumber, and what each of these frameworks actually means for open-source security.

An AI bot compromised 5 of 7 major repos in one week via CI/CD misconfigurations. A call to govern, not patch. Why CI/CD compliance and pipeline governance must become standard.

Point Base: Securing 1k+ Monthly Pipelines & Cutting CI/CD Overhead with Plumber

A hands-on walkthrough of using Plumber to scan your GitLab CI/CD pipelines for compliance issues from install to continuous monitoring in under 5 minutes.

Introducing Plumber 1.0: a fresh identity, enhanced user activity tracking, and chart time range customization

Shai-Hulud 2.0 is a massive supply chain attack targeting CI/CD pipelines via malicious npm packages. Learn how to detect it and secure your GitLab & GitHub workflows immediately.

Critical security alert: Learn about the TJ Actions supply chain attack and how to protect your GitLab CI/CD pipelines from similar threats.

Plumber est lauréat du programme France 2030 – NCC-FR Cyber, opéré par Bpifrance et l'ANSSI, pour accélérer la sécurisation des pipelines CI/CD.

Explore the top 5 software supply chain security incidents, including the SolarWinds attack and Codecov breach. Learn how these high-profile breaches highlight critical security vulnerabilities and best practices to protect your software supply chain