8 CI/CD security best practices: Protect your software pipeline

This report provides eight best practices for securing CI/CD pipelines, stressing that CI/CD tooling is part of the software supply chain and citing the JetBrains TeamCity RCE—exploited by North Korean actors—as a cautionary example. It recommends enforcing least-privilege and MFA, strengthening secrets management, building continuous monitoring and observability, implementing security-as-code guardrails and gates, centralizing and hardening code signing per CA/B Forum requirements, managing security artifacts in registries, and continuously threat-modeling the pipeline to reduce risk across the development lifecycle.