# Chainguard's Trail of Bits security assessment

DevFeed: [Chainguard's Trail of Bits security assessment](<https://devfeed.tech/articles/chainguard-s-trail-of-bits-security-assessment-12997.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguards-trail-of-bits-security-assessment>)

Published: 2024-05-14T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Code review](<https://devfeed.tech/topics/code-review.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [code-review](<https://devfeed.tech/tags/code-review.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [github-credentials](<https://devfeed.tech/tags/github-credentials.md>), [github-pat](<https://devfeed.tech/tags/github-pat.md>), [least-privilege](<https://devfeed.tech/tags/least-privilege.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [octo-sts](<https://devfeed.tech/tags/octo-sts.md>), [security](<https://devfeed.tech/tags/security.md>), [software-security-audit](<https://devfeed.tech/tags/software-security-audit.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

## AI overview

Chainguard describes an independent Trail of Bits security assessment of its production environment and supply-chain defenses. The assessment found no critical issues, but identified command injection in a GitHub Action and insufficient redaction of sensitive CloudEvents; Chainguard reports that both issues were fixed. The article also outlines security improvements involving GitHub credentials, GitHub Actions monitoring, FIDO security keys, anomaly monitoring, and production-network alerts.

## Source excerpt

Trust but verify: Read about Chainguard's independent security assessment by Trail of Bits and our dedication to transparency in security practices.