Security gates

A gate that regularly blocks delivery gets switched off, and one that never blocks anything is decoration.

That is the tension in every automated security check in a pipeline. Making it useful means tuning it to the small number of things that genuinely must not ship, rather than everything that could theoretically matter. Teams that fail to do this end up with a gate set to warn, which nobody reads.

Checked against the primary source.

More on Software supply chain & DevSecOps