❌

Visualização normal

Hoje — 9 de Maio de 2026Stream principal
  • ✇Technical Information Security Content & Discussion
  • Securing CI/CD for an open source project: lessons from Cilium /u/xmull1gan
    As a maintainer, this is Cilium's take on how we secure our Github Actions in the OSS project. A few highlights: SHA pinning every GitHub Action Separating trusted vs untrusted code paths in pull_request_target Isolating CI credentials from production release credentials Cosign signing + SBOM attestations Vendoring Go dependencies to make supply chain changes visible in review Treating blast radius reduction as the core design principle and a few gaps: no SLSA provenance yet remaining mutable
     
  • ↗️

Securing CI/CD for an open source project: lessons from Cilium

✇Technical Information Security Content & Discussion
Por:/u/xmull1gan
8 de Maio de 2026, 17:46

As a maintainer, this is Cilium's take on how we secure our Github Actions in the OSS project. A few highlights:

  • SHA pinning every GitHub Action
  • Separating trusted vs untrusted code paths in pull_request_target
  • Isolating CI credentials from production release credentials
  • Cosign signing + SBOM attestations
  • Vendoring Go dependencies to make supply chain changes visible in review
  • Treating blast radius reduction as the core design principle

and a few gaps:

  • no SLSA provenance yet
  • remaining mutable u/main references
  • no dependency review at PR time
  • missing govulncheck integration
submitted by /u/xmull1gan
[link] [comments]
Antes de ontemStream principal
  • ✇cybersecurity
  • eBPF secrets injection /u/xmull1gan
    Uses eBPF for secrets injection so your app never has access to them. Basically instead of having the application itself have access to secrets, it uses a "key" to identify which secret to use (like: "kloak:<uuid>" which then eBPF magic swaps it at the transport layer. So, applications never have access, so they cannot leak what they don't know. Happens all within the kernel. submitted by /u/xmull1gan [link] [comments]
     
  • ↗️

eBPF secrets injection

✇cybersecurity
Por:/u/xmull1gan
28 de Abril de 2026, 05:58
eBPF secrets injection

Uses eBPF for secrets injection so your app never has access to them.

Basically instead of having the application itself have access to secrets, it uses a "key" to identify which secret to use (like: "kloak:<uuid>" which then eBPF magic swaps it at the transport layer. So, applications never have access, so they cannot leak what they don't know. Happens all within the kernel.

submitted by /u/xmull1gan
[link] [comments]
❌
❌