github-actions

1 post · all tags

  • Your CI Pipeline Is the Softest Target You Own

    Your production database has a WAF, an audit log, and a quarterly review. Your CI runner has a copy of the credentials to it, executes arbitrary code from every branch, and has never once been threat modeled.

    Attackers noticed this asymmetry years ago. Build systems are where the secrets are, and unlike production, nobody is watching them.