Also known as: continuous integration · continuous delivery · build pipeline
CI/CD (continuous integration and continuous delivery) is the practice of automatically building, testing, and deploying code changes, so that every commit is verified and releases become routine rather than exceptional events.
The engineering benefit is fast feedback and small, low-risk changes. The security consideration is often underweighted: CI systems hold credentials to production, source code, and artifact registries, making them among the highest-value targets in an organisation.
A compromised build pipeline can inject malicious code into signed artifacts distributed to every downstream consumer, which is why build infrastructure warrants isolation, scoped credentials, and audit logging at least as strong as production itself.
Supply Chain Attack
A supply chain attack compromises an organisation indirectly by targeting a trusted supplier, dependency, or software update mechanism, so that malicious code arrives through a channel the victim already trusts.
SLSA
SLSA (Supply-chain Levels for Software Artifacts) is a security framework that defines graduated levels of build integrity, describing increasingly rigorous requirements for how software artifacts are produced and verified.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.
Fuzzing
Fuzzing is an automated testing technique that feeds a program large volumes of malformed, unexpected, or random input to discover crashes, hangs, and memory-safety violations.
Static Analysis
Static analysis examines source code without executing it, detecting bugs, security vulnerabilities, and style violations by reasoning about possible program behaviours.