CI/CD Pipeline Credential Exposure

CriticalDevOps SecurityOWASP DevSecOps Guideline

CI/CD pipelines expose secrets through plaintext environment variables, verbose build logs, misconfigured artifact storage, or overly broad secret access, enabling attackers to harvest production credentials and cloud API keys.

Immediate Response

1Rotate all secrets and credentials accessible from the affected CI/CD pipeline immediately.
2Scrub exposed secrets from build logs and artifact storage.
3Restrict pipeline secret access to trusted branches and approved workflows only.
4Audit pipeline access logs to determine if exposed credentials were harvested.

All playbooks

1Use masked secret variables provided by CI/CD platforms instead of plaintext environment variables.
2Implement secret scanning in build logs to detect and redact leaked credentials automatically.
3Apply least-privilege scoping so each pipeline job accesses only the secrets it requires.
4Block forked pull requests from accessing pipeline secrets without explicit approval.

Long-term Prevention

1Integrate a secrets management vault (HashiCorp Vault, AWS Secrets Manager) with CI/CD pipelines.
2Implement OIDC-based workload identity federation to eliminate static credentials in pipelines.
3Deploy continuous secret scanning across all CI/CD configurations and build outputs.
4Conduct regular pipeline security audits and secret exposure assessments.

Attack vectors

Secrets printed to build logs through debug statements or verbose output
Environment variables with production credentials accessible to all pipeline jobs
Build artifacts containing configuration files with embedded secrets
Forked pull requests accessing pipeline secrets in CI workflows

Indicators of compromise

Secrets or API keys visible in CI/CD build logs or console output
Pipeline environment variables containing production credentials accessible to untrusted jobs
Build artifacts in artifact repositories containing configuration files with secrets
Unexpected access to pipeline secrets from pull requests originating from forks

Tooling

HashiCorp VaultGitHub Actions SecretsGitLab CI/CD VariablesTruffleHogSnyk