CI/CD pipelines are one of the easiest places to leak secrets because they combine code, automation, and third-party integrations. A mistake in one place can expose credentials to logs, forks, artifacts, or downstream jobs.
Common failure modes
- Secrets printed in build logs
- Untrusted pull requests getting access to privileged credentials
- Overly broad environment secrets shared across too many jobs
- Long-lived tokens that never rotate
- Artifacts or caches containing sensitive data
What to do instead
- Limit secret scope to the smallest job or environment possible
- Use short-lived credentials when the platform supports them
- Protect release jobs from untrusted contributors
- Mask sensitive values and avoid echoing them in scripts
- Review workflow changes like application code, not just YAML
Why this matters
A secure app can still be compromised by a sloppy pipeline. If attackers can reach your secrets in CI, they can often reach your production systems too. That is why CI/CD deserves the same review rigor as the code being shipped.