WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2025 • Aug 20, 2025 • Session details

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

When hackers breached Codecov, they weaponized dependencies to pivot across organizations. Learn concrete strategies to harden your CI/CD pipelines against real-world supply chain attacks.

Pause
Mute Enter Fullscreen
#1 about 2 min

The problem with abstract security metaphors

Skirting technical details in favor of imagery hinders the deployment of actionable defense patterns.

#2 about 4 min

Flaws in vague supply chain security advice

Replacing vague concepts like mapping infrastructure with concrete code implementations ensures stronger threat prevention.

#3 about 4 min

Analyzing the Codecov bash uploader script breach

Leaked storage secrets inside public containers allow attackers to alter continuous integration automation scripts.

#4 about 2 min

Securing build time credentials in Docker containers

Suppressing files within sequential Docker layers fails to effectively purge sensitive build credentials.

#5 about 4 min

Validating installation scripts and external downloads safely

Verifying direct bash downloads with robust checksums or signatures prevents execution of corrupted binaries.

#6 about 2 min

Risks of storing credentials in environment variables

Embedding configurations within environment formats unnecessarily risks widespread credential exposure across entire execution environments.

#7 about 5 min

Compromised dependencies in GitHub Action workflows

Indirect dependencies compromising review workflows demonstrate the collateral surface area of targeted pipeline attacks.

#8 about 2 min

Mitigating repository vulnerabilities through contributor verification

Enforcing rigorous commit signing and tag restrictions protects core repositories from unauthorized behavioral shifts.

#9 about 2 min

Pinning automation processes to cryptographic digests

Binding automation steps to explicit cryptographic digests ensures environments execute immutable container configurations.

#10 about 3 min

Eliminating long-lived credentials to reduce exposure patterns

Replacing long-lived authentication keys with temporary workflow identities significantly narrows unauthorized access windows.

Matching moments

3:36 min

Understanding software supply chain threats and security risks

Andrei Epure Andrei Epure · WWC 2024

3:09 min

Practical mitigation strategies for modern software supply chains

Adrian Mouat Adrian Mouat · WWC Europe 2026

3:10 min

Implementing preventative cybersecurity to mitigate software supply chain risks

Coffee With Developers

2:46 min

Mapping the complete software supply chain attack surface

Matthew Brady Matthew Brady · WWC Europe 2026

1:16 min

Avoiding supply chain risks within standard software dependencies

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

1:37 min

Introduction to supply chain security principles

Zbyszek Tenerowicz · LIVE

More from World Congress 2025

GenAI Security: Navigating the Unseen Iceberg thumbnail
24:33
10 months ago

GenAI Security: Navigating the Unseen Iceberg

Maish Saidel-Keesing

Behind the Code: How Women Are Powering the Future of AI thumbnail
30:28
12 months ago

Behind the Code: How Women Are Powering the Future of AI

Alexandra Wudel, Laura Moritz, Madalina Florean

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise? thumbnail
28:12
12 months ago

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise?

Justus Lumpe, Konstantin Vinogradov, Nils Eiteneyer, Stephan Wirris

AI in Leadership: How Technology is Reshaping Executive Roles thumbnail
28:19
12 months ago

AI in Leadership: How Technology is Reshaping Executive Roles

Bernd Datler, Jasmin Kaiser, Jeff Hausmann, Sonja Alvarez

The AI-Ready Stack: Rethinking the Engineering Org of the Future thumbnail
28:09
12 months ago

The AI-Ready Stack: Rethinking the Engineering Org of the Future

Alex Laubscher, Jan Oberhauser, Keno Dreßel, Mirko Novakovic

AI Sovereignty: What Does It Take? thumbnail
29:13
12 months ago

AI Sovereignty: What Does It Take?

Boris Hecker, Clemens Wasner, Robin Hermann, Sonja Alvarez

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi
Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois

Related videos

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Securing your application software supply-chain thumbnail
28:27
WWC 2022 • about 4 years ago

Securing your application software supply-chain

Niels Tanis

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail
30:38
WWC Europe 2026 • about 1 month ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Security Pitfalls for Software Engineers thumbnail
27:32
WWC 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Securing Your Web Application Pipeline From Intruders thumbnail
44:30
LIVE • almost 6 years ago

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.