Application security is about building security into how software is designed, packaged, and shipped, not treating it as a final gate.
This section collects practical notes on supply chain visibility, pipeline controls, and the checks that help teams catch risk earlier.
Start here: CI/CD Security Pipeline.
A practical explanation of Azure managed identities, including system-assigned and user-assigned identities, token flow, and why they help reduce secret management risk.
A practical guide to handling secrets in CI/CD pipelines, covering storage, rotation, scoping, masking, and the controls that reduce accidental exposure.
A practical explanation of where container image scanning fits in DevSecOps, what it can and cannot detect, and how teams should use the results without slowing delivery unnecessarily.
A practical overview of the security checks that fit into a modern CI/CD pipeline, including SBOM generation, dependency scanning, secrets detection, image scanning, signing, and release controls.