YouShallNotPass! Hardening CI/CD pipelines on mission critical environments

This blog post introduces YouShallNotPass (YSNP), an open-source custom CI/CD runner and validation service that integrates with GitLab/GitHub and HashiCorp Vault to enforce security controls (repo, image, script, and user checks) prior to job execution. It covers architecture, custom executor scripts for GitLab and GitHub, Vault-based configuration and ACLs, integration testing, and practical use cases demonstrating how YSNP prevents runner hijacking, malicious pipeline modifications, and user impersonation attacks.