3 posts found.
Four articles on the two things an auditor and an integrator both need: evidence that survives scrutiny, and integrations that do not leak authority, from the inbound front door to the governed CI/CD loop with zero stored secrets.
Every integration is a doorway, and most platforms prop theirs open with standing credentials. OpsChain governs the crossing itself. Inbound events are signed and replay-protected, outbound credentials are just-in-time and scoped, and every crossing is audited.
OIDC identity in, just-in-time scoped tokens and attestations out, repository events in. The GitHub integration closes the loop so every deployment is approved, executed and attested, with no standing credential on either side.