Behind the Firewall ft. Randy Bartels
by Morgan Prost / May 22nd, 2026
Don’t just secure your code, secure the systems that build it.
VP of Security Services, Randy Bartels, has seen a major shift in how teams manage their CI/CD pipelines. Jenkins, CircleCI, and other tools are being replaced by GitHub Actions at a rapid pace, but with that shift comes a new layer of responsibility: securing the runners—the Docker containers that execute the workflows and produce the artifacts used in production.
In a recent team conversation, Randy pointed out that companies who host GitHub Enterprise internally must carefully manage their own runners. These containers consume YAML files and perform actions, but they also compile and deliver the very code that ends up in production. If the runner environment is compromised, so is everything it builds.
Whether you’re pursuing SOC 2, PCI, or just trying to maintain a secure pipeline, the takeaway is clear: the security of your automation environment is just as important as the security of your application.
