TLDR Tech / InfoSec
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure (17 minute read)
Mandiant's blueprint outlines a five-pillar strategy for hardening the SDLC: endpoint, repositories, artifacts, CI/CD, and deployment. Key recommendations include a seven-day cooldown for new public package versions, pinning images and actions to digests, using ephemeral runners with restricted egress, and replacing PATs with GitHub Apps or hardware-backed SSH keys. For AI coding agents, it advises keeping .env files out of model context and requiring human review of generated code.
Read the full story