Your CI/CD pipeline has production credentials, deploys to production, and is often the least secured system in your infrastructure. Attackers know this.
Seven critical areas to lock down before your pipeline becomes the breach vector.
CI/CD systems are trusted by design. They pull code, execute arbitrary commands, access secrets, build artifacts, and deploy to production. Compromise the pipeline — compromise everything downstream.
The OWASP CI/CD Security Top 10 documents the most critical risks. Most organizations fail on at least seven of ten categories.
| Incident | Vector | Impact |
|---|---|---|
| SolarWinds (2020) | Compromised build system injected backdoor into Orion updates | 18,000 organizations, including US government agencies |
| Codecov (2021) | Modified bash uploader script exfiltrated CI environment variables | Thousands of repos' secrets stolen over 2 months |
| ua-parser-js (2021) | NPM account takeover, cryptominer injected into package | 8M weekly downloads compromised |
| 3CX (2023) | Supply chain attack through compromised upstream dependency | 600,000 customer installations affected |
Common thread: attackers did not breach the target directly. They compromised a trusted component in the build chain, and the pipeline did the rest.
Additional controls: pin actions/plugins to commit SHAs (not tags — tags are mutable), use ephemeral runners that are destroyed after each job, and isolate pipeline execution environments.
Self-hosted runners are particularly dangerous: a malicious PR can execute arbitrary code on your infrastructure unless you restrict fork PR workflows.
Critical: do not just scan — gate deployments on results. A scan that produces warnings no one reads is security theater. Define severity thresholds that block merges and break builds.
Secret scanning (GitLeaks, TruffleHog) catches credentials committed to repos. Run it pre-commit and in CI.
The combination of signed artifacts + SBOM + provenance attestation creates a verifiable chain of custody from source code to production deployment.
Shift-left does not mean dumping security tools on developers. It means giving developers fast, actionable feedback in the tools they already use — IDE, PR, CLI.
A security gate that takes 45 minutes will be bypassed. A scan that returns 2,000 findings will be ignored. Prioritize, tune, and make the secure path the easiest path.
Treat your CI/CD pipeline as a production system: audit access, rotate credentials, monitor for anomalies, apply least privilege, and maintain an incident response plan for pipeline compromise.
The pipeline is the software supply chain. Securing it is not optional — it is existential.