Global AppSec Dublin: Empowering The Guardians Of Your Code Kingdom

## One Repository, Many Deployment Surfaces

At OWASP Global AppSec Dublin, a speaker from Permit.io describes securing a complex backend monorepo housing seven microservices, internal DevOps tooling, third-party dependencies like Redis, customized charts, and extensive infrastructure-as-code. A single repository feeds more than ten independent deployment points—each a potential launch facility for attackers.

## The Push Model's Permission Problem

Traditional CI/CD pushes changes into production using credentials that can exfiltrate secrets or deploy malicious artifacts. Granting pipelines broad write access across environments multiplies blast radius when credentials leak or pipelines compromise.

## Pull-Based Deployment as AppSec Strategy

The proposed remedy: eliminate push permissions entirely. Environment-side agents or sidecars pull desired state from trusted sources using scoped service accounts unusable outside the cluster. Tools like Argo CD and Flux exemplify this GitOps pattern in Kubernetes, consolidating disparate deployment paths into one auditable pull workflow.

## Empowering Security Champions

Streamlining deployment architecture lets application security teams focus on guardianship—reviewing what enters the repository—rather than firefighting ten divergent release mechanisms. Pull-based models reduce credential exposure and align with zero-standing-privilege principles across cloud-native estates.