DevSecOps Best Practices for Teams That Ship Every Week

A guide to enterprise GitLab rollouts comparing GitLab.com, Dedicated, and self-managed models, with planning guidance for runners, availability, disaster recovery, and pipeline performance at scale.

Borg argues the security-review queue blocking releases is a capacity problem: scanners cover known-bad patterns, so reserve humans for judgement calls like intended authorization boundaries.

Wiz's 2025 State of Code Security report: 35% of GitHub repos are public, 61% of organizations have cloud secrets exposed in public repos, and self-hosted CI/CD runners raise lateral-movement risk.

A GrammaTech guest post argues DevSecOps pipelines alone miss the adversarial view; pairing SAST automation with offensive security closes the blind spot where design and code flaws slip through.

Everything to know about the tj-actions/changed-files supply chain attack (CVE-2025-30066): how the compromise leaked CI secrets in public repo logs, attribution clues, and mitigation guidance.

Docker container security beyond images: pin minimal base images, run as non-root with dropped capabilities and read-only filesystems, keep secrets out of build contexts, and gate registry pushes.