What least privilege actually means for an autonomous AI coding agent that runs shell commands: sandbox primitives (bubblewrap/Seatbelt/gVisor/Firecracker), capability dropping, ephemeral scoped credentials, and named 20...
Pipeline security misconfigurations documented in real 2025-2026 breach postmortems - tj-actions/changed-files, Pwn Request pull_request_target attacks, GitHub Actions cache poisoning, npm worm supply-chain incidents - p...
Non-default hardening flags for Docker/OCI image builds: BuildKit SBOM/provenance attestation, cosign/Sigstore signing, rootless-mode trade-offs, distroless CVE deltas with real numbers, and named supply-chain incidents ...
Complete reference for configuring and using Gitea Actions as a built-in CI/CD solution. Covers .gitea directory structure, workflow YAML syntax, runner setup, GITEA_TOKEN permissions, secrets, variables, scoped workflow...