Secure CI/CD Hardening with Jenkins, BitBucket and JFrog in Zero-Trust DevOps

Abstract

The idea of secure environments of continuous integration and continuous delivery has emerged as an object of study due to the fact that current delivery pipelines concentrate privileged automation, dependency resolution, artifact handling, and release control within a small number of highly interconnected systems. This concentration also becomes a design issue in zero-trust DevOps where every single interaction in a pipeline is assumed to be untrusted until identity and integrity are established and policy compliance and provenance are verified. This survey discusses secure CI/CD hardening through the practical lens of Jenkins, Bitbucket, and JFrog, treating these systems as focal platforms for pipeline orchestration, source-code governance, and artifact trust. The literature indicates that conventional perimeter-focused protective approaches have been replaced by policy-based, evidence-based, and identity-oriented controls, which focus on least privilege, continuous verification, signed artifacts, infrastructure-as-code inspection, and supply chain visibility. Key themes include barriers to DevSecOps adoption, zero-trust design, maturity and performance metrics, software bill of materials adoption, infrastructure misconfiguration, code integrity, and patch reliability. It has been repeatedly reported that tooling is insufficient when organizational practices, trust boundaries, and feedback loops are weak. Persistent gaps include limited cross-platform empirical research, insufficient product-specific evaluation, underdeveloped provenance metrics, and inadequate attention to artifact repositories as valuable control points. Jenkins-BitBucket-JFrog pipeline hardening is thus reliant on synchronized controls on code, build, repository, identity, and release levels rather than the deployment of a single scanner.