WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Oct 12, 2020

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Is your CI/CD pipeline an open door for attackers? Embed automated security testing directly into your deployments to stop threats without sacrificing release velocity.

Pause
Mute Enter Fullscreen
#1 about 4 min

Introduction to securing web application deployment pipelines

Mitigating the escalating risks of data breaches requires implementing proactive security measures directly inside deployment workflows.

#2 about 5 min

Establishing best practices for efficient deployment pipelines

Small build sizes and parity between staging and production environments prioritize fast and reliable code deployments.

#3 about 5 min

Why continuous integration security is often overlooked

The shift left movement imposes time constraints and unfamiliar configurations that delay pipeline security integration.

#4 about 5 min

Tactics and tools used by external malicious actors

External attackers leverage automated suites, misconfigurations, leaked secrets, and outdated dependencies to compromise existing software.

#5 about 4 min

Integrating static security scanning in the build phase

Software composition analysis scanners identify vulnerable dependencies before compiled artifacts reach subsequent deployment stages.

#6 about 3 min

Dynamic application security testing during the test phase

Dynamic and interactive application scanners actively detect runtime vulnerabilities like cross-site scripting and authentication failures.

#7 about 3 min

Running compliance and security audits in pre-production delivery

Specialized pre-production checks enforce regulatory compliance and prevent destructive database queries before production deployment.

#8 about 3 min

Managing vulnerabilities in production environments through bug bounties

Crowdsourced human testing uncovers deeply hidden logic flaws that automated tools miss in production systems.

#9 about 7 min

Implementing manual security practices and pipeline configuration management

Routine management of user access permissions and deployment controls prevents unauthorized pipeline usage and data leaks.

#10 about 4 min

Embedding automated vulnerability analysis within CircleCI workflows

Utilizing dedicated security orbs within YAML configurations surfaces critical dependency risks dynamically during scheduled builds.

#11 about 3 min

Constructing secure Python deployment sequences using Conductor

Structuring continuous delivery flows through Python rather than YAML streamlines dependency testing and containerized node execution.

#12 about 2 min

Configuring open source dependency tests in Travis CI

Adding security commands to standard open source build configurations blocks known vulnerabilities from entering public codebases.

#13 about 3 min

Reviewing core strategies for robust pipeline security

Committing to proactive credential scanning and routine pipeline audits blocks attackers from discovering easily explorable backdoors.

Matching moments

1:07 min

Evaluating current trends in CI/CD pipelines

Dominik Kress · LIVE

1:00 min

Encouraging broader team adoption of security automation practices

Ramona Schwering Ramona Schwering · World Congress 2024

3:30 min

Integrating security into initial continuous integration deployment pipelines

Thomas Fuchs +3 · LIVE

3:05 min

Injecting automated security into mobile CI/CD pipelines

Moataz Nabil Moataz Nabil · LIVE

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

2:02 min

Integrating security controls into the software development lifecycle

Jose Manuel Ortega Jose Manuel Ortega · Europe 2026 Virtual

More from WeAreDevelopers LIVE

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
4 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
9 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail
1:04:42
10 days ago

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail
48:06
17 days ago

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail
7:41
18 days ago

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
about 1 month ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate, Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 2

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

September 23, 2026 · 14:00–14:30

Stage 1

Supply Chain Security When Agents Write the Code

Ajeet Raina

Developer Advocate, Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

How Docker caught a supply chain attack in 83 minutes

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

September 25, 2026 · 12:30–14:30

Stage 11

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Front-End Advocate | Speaker | AI & DevOps | Docker Captain | Cursor Ambassador | DevReal | Tech Blogger | Book Author

Kristiyan Velkov

Related videos

Enabling automated 1-click customer deployments with built-in quality and security thumbnail
44:40
LIVE • almost 6 years ago

Enabling automated 1-click customer deployments with built-in quality and security

Christoph Ruggenthaler

DevSecOps: Injecting Security into Mobile CI/CD Pipelines thumbnail
45:08
LIVE • almost 5 years ago

DevSecOps: Injecting Security into Mobile CI/CD Pipelines

Moataz Nabil

Security Pitfalls for Software Engineers thumbnail
27:32
World Congress 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

DevSecOps culture thumbnail
16:00
World Congress 2023 • almost 3 years ago

DevSecOps culture

Ali Yazdani

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
World Congress 2022 • about 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

You can’t hack what you can’t see thumbnail
29:34
LIVE • almost 6 years ago

You can’t hack what you can’t see

Reto Kaeser

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.