Securing CI/CD Pipelines: A DevSecOps Framework for Preventing Credential Leaks and Misconfigurations

Secure CI/CD Hardening with Jenkins, BitBucket and JFrog in Zero-Trust DevOps

The idea of secure environments of continuous integration and continuous delivery has emerged as an object of study due to the fact that current delivery pipelines concentrate privileged automation, dependency resolution, artifact handling, and release control within a small number of highly interconnected systems. This concentration also becomes a design issue in zero-trust DevOps where every single interaction in a pipeline is assumed to be untrusted until identity and integrity are established and policy compliance and provenance are verified. This survey discusses secure CI/CD hardening through the practical lens of Jenkins, Bitbucket, and JFrog, treating these systems as focal platforms for pipeline orchestration, source-code governance, and artifact trust. The literature indicates that conventional perimeter-focused protective approaches have been replaced by policy-based, evidence-based, and identity-oriented controls, which focus on least privilege, continuous verification, signed artifacts, infrastructure-as-code inspection, and supply chain visibility. Key themes include barriers to DevSecOps adoption, zero-trust design, maturity and performance metrics, software bill of materials adoption, infrastructure misconfiguration, code integrity, and patch reliability. It has been repeatedly reported that tooling is insufficient when organizational practices, trust boundaries, and feedback loops are weak. Persistent gaps include limited cross-platform empirical research, insufficient product-specific evaluation, underdeveloped provenance metrics, and inadequate attention to artifact repositories as valuable control points. Jenkins-BitBucket-JFrog pipeline hardening is thus reliant on synchronized controls on code, build, repository, identity, and release levels rather than the deployment of a single scanner.

A cryptographically verified approach to secure Docker container updates in CI/CD pipelines

A secure CI/CD update workflow that combines keyless Cosign signing (OIDC/Fulcio), immutable SHA-256 digest–based image addressing, mandatory pre-deployment signature verification, and freshness controls against rollback attacks is presented, while permitting controlled rollback only to previously verified versions.

DevSecOps policy-as-code: Detecting and remediating over-privileged access tokens in SDLC tools

GuixChain: Enforcing Reproducible Builds and Provenance Integrity for Secure Automotive OTA Pipelines

Ensuring the integrity of automotive software, from source code to deployed binaries, has become critical as vehicles increasingly rely on over-the-air (OTA) updates and complex supply chains. The Uptane framework secures OTA update delivery for automotive systems but does not enforce integrity within the upstream software supply chain, leaving the gap between source commits and deployed artifacts unverified. We present GuixChain, a blockchain-backed reproducible build layer that enforces multi-party consensus before artifacts enter OTA pipelines. GuixChain combines deterministic GNU Guix builds, cryptographic SBOM binding, and Hyperledger Fabric smart contracts. Together, these components ensure that only independently verified, bit-identical binaries are deployed. Evaluation across a consortium representing OEMs, suppliers, and auditors demonstrated reliable reproducibility over 30 build cycles. Fault injection experiments covering four threat categories were fully detected with low latency (1.8–2.4 seconds). The system maintained modest overheads (15–19% CPU, 1.4–3.5.GB memory, 41–60MB disk), with blockchain consensus adding only 2–3 seconds to build verification. Multi-node consensus yielding total build-to-verification time of 30–38 seconds per validator. By enforcing consensus-based reproducibility upstream of Uptane, GuixChain provides a scalable and verifiable supply chain integrity layer, bridging the gap between source-level trust and safe deployment, while remaining compatible with existing automotive OTA infrastructure.

An Adaptive Risk-Driven DevSecOps Framework for Securing Multi-Cloud Enterprise Systems in the Era of Agentic AI

The Adaptive Risk-Driven DevSecOps Framework (ARDDSF) is proposed, a layered framework for securing multi-cloud enterprise systems in the era of agentic artificial intelligence that bridges DevSecOps automation, AI-assisted security analysis, Zero Trust policy enforcement, and multi-cloud governance.

Improving the Security of Containerized Workloads using Transparency and Traceability Services

This paper presents an architecture for verifiable container image distribution that addresses key-management challenges and enables policy-enforced admission-time verification, and implements a proof-of-concept integrated with GitHub Actions and GitLab Runners that mitigates common supply-chain attacks under a realistic threat model.