To Detect and Mitigate the Risk in Continuous Integration and Continues Deployments (CI/CD) Pipelines in Supply Chain Using Snyk tool

Continuous Integration/Continuous Deployment (CI/CD) is an approach of software development that enables teams to automate the build, testing, and deployment of applications, resulting in faster and more efficient software delivery. However, the CI/CD pipeline can become a potential target for vulnerabilities and attacks, leading to severe consequences for the software development process and the overall security of the system. In addition to introducing CI/CD, this study also looks at potential pipeline vulnerabilities. It describes many attack vectors that can jeopardise the software's availability, confidentiality, and integrity, such as malicious code injection, unauthorised access, and exploitation of misconfigurations. In the CI/CD pipeline, cutting-edge there are few security techniques have been used to mitigate these vulnerabilities. Tools that are mainly used in this study include CodeQL, SLSA, and Snyk.