← Back to Board
background tools & workflows 1 sources

I’ve been experimenting with deterministic secret remediation in CI/CD pipelines using Python AST (refuses unsafe fixes)

I’ve been experimenting with a slightly different approach to secret handling in CI/CD pipelines. Most scanners detect hardcoded secrets, but the remediation is still manual. The pipeline fails, someone edits the file, commits again, and reruns the build. I wanted to see if the obvious safe cases could be automated. The idea was to see if secret remediation could be automated safely enough to run directly inside CI pipelines. So I started experimenting with a small tool that: - scans Python repo

Reported by r/devops. Monitor for further developments.