4 ms·
Just spitballing, how about: requiring 2FA to access the CI/CD tool, and requiring signed commits for your source code.
by mumblemumble 6y ago
Just spitballing, how about: requiring 2FA to access the CI/CD tool, and requiring signed commits for your source code.
- ArchOversight 6y agoUnless you are also verifying that the signed commits are from particular users, and don't allow any tooling to create unsigned commits, that might work, but many of the issues we found weren't even about the code itself.