Summary

Safety starts at home, which means ensuring that your code-writing tools are safe. Threats can come in (or be created unintentionally) through vulnerabilities or poisoning in your IDE, its plugins, open source components, improperly scoped roles and permissions in your SCM tools, improperly configured internal CI/CD options in your SCM tools, and from AI-generated code.

All of these are parts of your SSC. If you follow these recommendations and secure them properly, you give attackers a much smaller and less visible attack surface and shine a brighter light on their activities.

In the next chapter, we are going to explore one of the most pervasive vulnerabilities threatening code security today and how to prevent it: hardcoded secrets.