How Chainguard Built Comprehensive Security Review Across Its Codebase and CI/CD Workflows

Chainguard builds hardened, verifiable, production-ready versions of the open source software engineering teams depend on, including containers, libraries, packages, CI/CD actions, agent skills, and virtual machine images. Its products give organizations a trusted source for open source components across the software supply chain.

For most of his career in product security, Jorge Lucangeli had to concentrate detailed review on selected parts of the development lifecycle. Architecture and design reviews covered the highest-level risks, while line-by-line inspection stayed selective because the volume of code changing across an organization exceeded the time available for comprehensive manual review.

Chainguard faced the same capacity constraint. As teams adopted Claude Code, Codex, and other coding agents, pull request volume increased further while architecture work, policy, vulnerability management, and investigations continued to require the product security team’s attention.

Chainguard uses depthfirst across two complementary workflows. Code scanning searches existing code for vulnerabilities across its repositories, while depthfirst’s Security Reviewer analyzes new changes and surfaces findings directly in GitHub pull requests. Together, they extend detailed security review across vulnerabilities already present in the codebase and issues introduced as engineers ship new code.

Chainguard uses depthfirst’s AI code scanner to identify vulnerabilities across its codebase. The team has found the prioritization accurate, with engineers reporting that many of the vulnerabilities depthfirst surfaces are legitimate issues they can act on and remediate. This gives product security a reliable starting point for deciding which findings require engineering attention.

depthfirst’s agents reason through the conditions required for a vulnerability to be exploitable and validate whether those conditions are satisfied. For vulnerabilities in third-party dependencies, depthfirst also checks whether the affected functions are reachable from the application. This gives Chainguard stronger signals for prioritization and helps engineers focus remediation on findings with a realistic path to impact.

Chainguard has automated the handoff from depthfirst into Linear. New findings are checked against existing issues, deduplicated, routed to the appropriate team, and filed into the ticketing system; when the Linear issue is closed, the corresponding depthfirst finding is updated. That routing is especially useful in Chainguard’s large monorepo, where ownership depends on context beyond a simple repository-to-team mapping.

The team also use context and feedback to improve the quality of findings over time. They can encode guidance for how recurring security patterns should be handled across the development process, as well as provide feedback to individual findings. They have seen precision improve over time as information accumulates, giving engineers a more precise set of findings to work from.

depthfirst’s Security Reviewer surfaces findings directly in GitHub pull requests, bringing security review into Chainguard’s CI/CD workflow before code is merged. Developers can investigate and resolve an issue while they still have the context of the change, making security feedback part of the normal code-review workflow.

The review also applies a consistent standard across pull requests. Findings follow the same structure and language across changes, giving developers a predictable security review experience and reducing the variability that comes with manual review from different people.

Chainguard can now maintain detailed security review across existing code and new changes while its product security team continues to own architecture, policy, vulnerability management, and investigations. As engineering output grows, depthfirst gives the team coverage across the development lifecycle that would be impractical to sustain otherwise.