Stop 09 · Cloud SecurityTopics · 7/9

Securing CI/CD Pipelines

In short

Your build pipeline can push code straight to production, so it holds powerful keys. If attackers compromise it, they can slip malicious code into every release unnoticed.

CI/CD pipelines have broad access to build, test, and deploy code — a compromised pipeline can inject malicious code directly into production, making pipeline security a high-value attacker target.

The blob guards a factory conveyor belt carrying neat packaged boxes.

Think of it like this

The factory conveyor belt

A factory conveyor takes raw parts and ships finished products. If a saboteur tampers with the belt, every product that follows is affected. A CI/CD pipeline is that belt for software, so guarding it protects everything it ships.

Watch it happen

A secured pipeline

Commit

Scan

Secrets

Sign

Deploy

1/5Code is committed, ideally reviewed and protected by branch rules.

The big ideas

What you need to know

No secrets in code

Pull keys and tokens from a secrets manager at run time. Hard coded secrets leak into git history forever.

Least privilege runners

Give the pipeline only the deploy permissions it needs, with short lived credentials, not god mode keys.

Verify what you ship

Sign artifacts and check the signature before deploy, so swapped or tampered builds are caught.

Protect the source

Require reviews and branch protection, so one bad commit cannot sail into production unseen.

Save yourself the pain

Common mistakes

Oops

Storing deploy keys as plain text in the pipeline config.

Do this instead

Use a secrets manager and inject at run time. Plaintext keys in config leak the moment the repo is shared.

Oops

Giving the CI runner broad, permanent cloud admin.

Do this instead

Scope its permissions tightly and use short lived credentials, so a compromised runner cannot own the account.

Your mission

Harden a sample pipeline

~40 min

Quick check

Why is a CI/CD pipeline an attractive target for attackers?

Go deeper

1Audit a sample CI/CD pipeline configuration for hardcoded secrets or overly broad permissions.
2Learn why supply chain attacks (compromising a build pipeline) are an increasingly common real threat.
3Understand secrets management (not hardcoding credentials in pipeline configs) as a core defense.