Custom guide
Audit Process
How a System Meadowhub CI/CD pipeline audit runs from first brief to findings workshop — so you know what to prepare and what you receive.
Brief and fit check
You describe CI host, services, and release symptoms. We confirm whether a full audit, readiness review, or enablement block is the right shape — and decline work that needs a different specialty (for example, application penetration testing).
Access and ground rules
We agree on read-only access, a named client contact, and a change freeze: we observe and document during the audit window; we do not edit production workflows unless you later commission remediation.
Desk review of real jobs
We inventory pipelines that promote to staging and production, trace secrets and runners, and note gates that can be skipped. Large numbers on the findings page are reserved for severity counts you can verify — not vanity metrics.
Interviews on release day reality
Short conversations with the people who ship. The goal is to catch the gap between YAML and practice: who applies the bypass label, who holds the hotfix playbook, who can stop a bad deploy.
Findings pack and workshop
You receive a written pack with ranked risks and a two-week remediation map. The workshop walks the ranking so engineering and leadership leave with the same list. Optional coaching begins only if you commission it.
What to prepare before day one
- List of repositories and pipelines that can reach production
- One calm release and one painful release as reference
- Current incident or postmortem notes that mention delivery
- Decision-maker available for the findings workshop
