Security gates in CI for a one-person startup
By day I'm a security consultant. By night I'm the entire engineering department of AstraIQ. That second job has no security team to escalate to — which is precisely why the pipeline has security gates. When nobody is checking your work, the robots have to.
The gate set
Static analysis for insecure patterns, a dependency audit for known CVEs in what I import, and the full test suite — currently just under two thousand tests. Every push, no manual steps. No enterprise scanner, no dashboard subscription. That combination catches the overwhelming majority of what a solo developer actually ships wrong, and it costs nothing but pipeline minutes.
What actually broke
When my workflows fell over, I got to play incident responder on my own pipeline. The root causes were gloriously unglamorous: a service password in the wrong place in the environment config, an invalid flag passed to the security scanner itself, a dependency export format that made the audit abort before it audited anything, and a workflow pointing at the wrong token secret.
Not one exploit. Not one vulnerability. Four pieces of boring configuration — which is exactly how security tooling fails in the wild. It rarely gets defeated. It quietly stops running, and everyone keeps merging.
What I took from it
A gate that's red for config reasons trains you to ignore red. The most dangerous state isn't a failing check — it's one that's been failing so long, for such dull reasons, that red has stopped meaning anything. Fixing broken gates is security work, even when the fix is one environment variable.
The pipeline is production. It holds secrets and runs code on every push. Least-privilege tokens and knowing exactly what each workflow can reach is the same hygiene as the app itself, because a pipeline compromise is an app compromise.
The usual line is that you need a security team before you can have security process. Backwards, I think. You need the gates because there's no team — they're the colleague who reviews every push, never gets tired, and never assumes you knew what you were doing.