Game studios ship faster than almost any other software category — live-ops updates, weekly patches, seasonal content, and a CI/CD pipeline under constant pressure. That speed is exactly why security keeps getting deferred to “after launch,” until a leaked signing key, a poisoned dependency, or an exposed debug endpoint turns into a real incident. A compromised GitHub Actions workflow can leak build artifacts, cloud credentials, or package tokens before anyone notices — and by the time security shows up as a manual end-of-cycle audit, it’s already too late to be anything but a bottleneck.
The fix isn’t “add more scanners.” It’s treating your CI/CD pipeline itself as a first-class security architecture: least-privilege tokens, pinned actions, branch protection, layered scanning, evidence retention, and exception governance — all embedded directly into the pull-request workflow developers already use. This course builds exactly that, lab by lab, entirely inside real GitHub Actions.
