Map the path
Every route from a code change to a running artifact, including the ones nobody documented — manual deploys, break-glass accounts, self-hosted runners.
Practice 02 — DevSecOps
Your pipeline has more access than anyone who works there.
Build systems accumulate permissions the way garages accumulate boxes. The job is a path from code change to released artifact you can actually account for — with controls your engineers will not route around.
What sets the estimate
- Repositories
- Pipelines
- Registries and artefacts
- Deploy targets
- Release cadence
Scoped on the call, quoted in days, in writing.
Scope a pipeline review
A short call to understand how you build and ship, and to explain where a review usually pays for itself.
Times in
Loading available times…
Why teams call
You already suspect at least one of these.
- More people can push to production than you would name out loud.
- A personal access token somewhere has no expiry and full scope.
- Scanners run, findings accumulate, and nothing fails a build.
- You ship container images without knowing what is inside them.
- A maintainer account protected by SMS guards the release path.
What you get
The deliverables.
Pipeline
- SAST, DAST, SCA and SBOM tooling selected and tuned to your stack, with gates that fail honestly
- Container image and artifact scanning wired into the path to production
- Signed builds and provenance attestation, so a released artifact traces back to a commit
- Dependency pinning and lockfile integrity as an enforced control, not a convention
Organisation and identity
- GitHub organisation RBAC and team permissions cut to the minimum that still ships
- Fine-grained personal access tokens, scoped narrowly and expiring by default
- Hardware-backed MFA (YubiKey) for maintainers, release approvers and admins
- Branch protection, environment approvals, and a documented answer to who can ship
How it runs
Cut and instrument
Permissions reduced to what shipping requires, tooling placed where it blocks rather than where it reports, and MFA moved onto hardware for the accounts that matter.
Prove it holds
We re-run the path afterwards and show what a stolen token now reaches, with the findings register and 90-day sequence your team executes.
QuestionsBefore you
Before you
book the call.
We use GitLab, not GitHub.
Fine. The identity and permission work maps closely, and NIST SSDF and the OWASP CI/CD Top 10 are platform-neutral. Some specifics — fine-grained PATs, for instance — have different names and different limits, and we will say which.
Will this slow our engineers down?
Controls engineers route around are worse than no controls, so the design brief is explicitly that they will not. Where a gate costs real time, we say so and you decide.
Do we need to buy the scanning tools you recommend?
Usually not. Most stacks already have capable tooling switched off or untuned, and we do not resell anything, so there is no commission in the recommendation either way.
How does this relate to SLSA levels?
SLSA gives us a ladder to measure against rather than a target to chase. We will tell you which level your build process actually reaches today, and what the next rung costs.
Next step
Scope a pipeline review.
Thirty minutes, no obligation. We will tell you what is worth doing, including when the answer is less than you expected.