CI/CD pipelines are increasingly responsible for building software, provisioning infrastructure, publishing artifacts, and deploying production workloads. That makes the pipeline itself a significant part of the organization's attack surface. Security health cannot be measured by simply asking whether a vulnerability scanner is enabled. A healthy pipeline should demonstrate that security controls are consistently applied, vulnerabilities are addressed promptly, credentials are protected, a...