← ReflexSec
CI/CD
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Safe
curl -fsSL https://example.com/sbom.json -o ./sbom.jsonAdvanced - Safe
gh secret set NPM_TOKEN --repo example/app --body "$NEW_TOKEN"Expert - Safe
docker build --secret id=npmrc,src=$HOME/.npmrc -t app:ci .Expert - Safe
npm audit fixProIntermediate - Dangerous
pytest -k "not auth and not payments"ProIntermediate - Dangerous
rm package-lock.json && npm installProIntermediate - Safe
npm ci --ignore-scriptsProIntermediate - Safe
sudo apt-get install --only-upgrade opensslProIntermediate - Dangerous
echo "token=${{ secrets.NPM_TOKEN }}" >> $GITHUB_OUTPUTProAdvanced - Safe
pip install --require-hashes -r requirements.lockProIntermediate - Safe
curl -fsSL https://example.com/tool.tar.gz -o ./tool.tar.gz && sha256sum -c ./tool.sha256ProAdvanced - Dangerous
npm pkg set scripts.postinstall="node ./scripts/setup-env.js"ProExpert - Safe
Get-AuthenticodeSignature ./dist/installer.exe | Select-Object Status, StatusMessageProExpert - Safe
cat releases.json | jq --arg env prod '.deploys[] | select(.env == $env)'ProAdvanced - Safe
cat report.json | jq -r '.findings[].title' | sort -uProAdvanced - Safe
jq -L ./jq-lib 'include "fmt"; .items | fmt::table' report.jsonProAdvanced - Safe
jq -n --arg host "$DB_HOST" --arg port "$DB_PORT" '{host: $host, port: ($port|tonumber)}' > db.jsonProExpert - Safe
jq --slurpfile schema schema.json '. as $doc | $schema[0].required | all(. as $k | $doc | has($k))' payload.jsonProExpert - Dangerous
jq --slurpfile extra "$JQ_EXTRA_CONFIG" '. * $extra[0]' policy.json > policy.merged.jsonProNightmare - Safe
psql -h db.example.com -U app -f migrations/003_add_index.sqlProAdvanced - Safe
mysql -h db.example.com -u app -p app_production < schema.sqlProExpert - Safe
ansible-playbook -i inventory/prod --check --diff site.ymlProAdvanced - Dangerous
ansible-playbook -i inventory/prod site.yml --become --extra-vars "@/tmp/overrides.json"ProNightmare - Safe
pwsh -NoProfile -EncodedCommand RwBlAHQALQBMAG8AYwBhAHQAaQBvAG4AProExpert - Safe
Import-Module .\Modules\Ops\Ops.psd1 -ForceProExpert - Dangerous
Register-PSRepository -Name internal-tools -SourceLocation https://packages.example.net/nuget -InstallationPolicy TrustedProAdvanced - Safe
Get-ChildItem .\src -Recurse -Filter *.ps1 | Where-Object { Select-String -Path $_ -Pattern 'Invoke-Expression' -Quiet }ProNightmare - Safe
powershell.exe -ExecutionPolicy Bypass -NoProfile -File .\build\ci-test.ps1ProNightmare - Safe
helm upgrade --install api ./charts/api -f values.production.yamlProAdvanced - Dangerous
curl -sL https://raw.example.com/k8s/monitoring.yaml | kubectl apply -f -ProAdvanced - Safe
kustomize build ./overlays/production | kubectl diff -f -ProAdvanced - Dangerous
kubectl set image deployment/api api=registry.example.com/api:latest -n productionProAdvanced - Safe
helm rollback api 3 -n productionProAdvanced - Dangerous
helm install monitoring https://charts.example.net/monitoring-2.1.tgzProAdvanced - Safe
helm diff upgrade api ./charts/api -f values.production.yamlProExpert - Safe
KUBECONFIG=./clusters/staging.yaml kubectl apply -f ./k8s/ProExpert - Safe
helm get values api -n productionProExpert - Dangerous
KUBECONFIG=./clusters/prod.yaml kubectl apply -f ./k8s/api/ --prune -l app=apiProExpert - Safe
flux reconcile kustomization apps --with-sourceProExpert - Dangerous
flux suspend kustomization appsProExpert - Safe
argocd app diff production-apiProNightmare - Dangerous
argocd app sync production-api --prune --forceProNightmare - Safe
wget -q https://releases.example.com/agent-2.4.0.rpm && aws s3 cp agent-2.4.0.rpm s3://app-assets-example/agents/ProNightmare - Dangerous
ansible-playbook -i inventory reimage.yml --limit compromisedProNightmare - Dangerous
npm publish --access publicBeginner