CI/CD Providers

General

Article	Description
Mercari's Research	Common Threat Matrix for CI/CD Pipeline: An ATT&CK-like matrix focus on CI/CD Pipeline specific risk Attacking and Securing CI/CD Pipelines: A comprehensive summary of both the attack methods often used against CI/CD environments and Mercari's experience in securing CI/CD Defense Against Novel Threats: Redesigning CI at Mercari: Article discussing the effort to build Mercari's next generation CI system and some of their engineering solutions towards this effort Terraform CI code execution restrictions: A post explaining RCE via Provider and Provisioners, supply chain attack scenarios and mitigations Restructuring the Kubernetes Threat Matrix and Evaluating Attack Detection by Falco: post talking about some attack methods missing from the Threat matrix for Kubernetes published by Microsoft Supply-Chain Security: Evaluation of Threats and Mitigations: research into threat modeling for supply-chain, the evaluation of the effectiveness of each countermeasure such as SBOM, and the design of a centralized CI pipeline
OWASP Top 10 CI/CD Security Risks
Visualizing CI/CD from an attacker's perspective	Lessons learned and insight gained from a year of modeling and engineering CI/CD graphs from the attacker's perspective
10 real-world stories of how we’ve compromised CI/CD pipelines	Some of war stories from NCC about what they have observed and been able to demonstrate on CI/CD pipeline security assessments
Controlling the Source: Abusing Source Code Management Systems	A few ways to abuse some of the most popular source code management systems to perform various attack scenarios, like reconnaissance manipulation of user roles repository takeover pivoting to other DevOps systems user impersonation maintaining persistent access
Characterizing the Security of Github CI Workflows	Paper comparing 6 popular CI/CD platforms and how they enforce security properties like: Admittance Control, Execution Control, Code Control, and Access to Secrets
Attackers have better things to do than corrupt your builds	This posts clarifies the clucking and clamoring over attackers exploiting vulns or corrupting build pipelines (spoiler alert: it isn't worth their time and effort to)
69 Ways to F*** Up Your Deploy	A compendium of 69 ways to f*** up your deploy
Defending Continuous Integration/Continuous Delivery (CI/CD) Environments	A cybersecurity information sheet (from NSA and CISA) providing recommendations for improving defenses in cloud implementations of development, security, and operations (DevSecOps)
Source Code Management Platform Configuration Best Practices	Guide from OpenSSF exploring the best practices for securing GitHub and GitLab, covering topics that include user authentication, access control, permissions, monitoring, and logging
The separation of work and play	Mixing work and personal contexts can provide a better employee experience and increased security risk
The architecture of SAST tools: An explainer for developers	How SAST tools can help developers find and address vulnerabilities

GitHub

Articles

Article	Description
Securing GitHub organizations	Step-by-step process for securing your GitHub organization
Security hardening for GitHub Actions	Good security practices for using GitHub Actions features
Github Actions Security Best Practices	Some of the key security concerns you should be aware of when using Github Actions, alongside the best practices that Salesforce Heroku follows to securely use them
Building a GitOps CI/CD Pipeline with GitHub Actions (SOC 2)	How to build a GitOps-based CI/CD pipeline built on GitHub Actions, designed for SOC 2 compliance
Protect Your GitHub Actions with Semgrep	What can happen (secrets stolen, repo backdoored), and how to protect yourself with open source Semgrep rules
Secure deployments with OpenID Connect & GitHub Actions	GitHub Actions now supports OpenID Connect for secure deployment to different cloud providers via short-lived, auto-rotated tokens Identity Federation for GitHub Actions on AWS: How to configure your GitHub Actions build jobs to securely and seamlessly use IAM Roles in AWS Enabling keyless authentication from GitHub Actions: authenticate from GitHub Actions to Google Cloud using Workload Identity Federation
Leaking Secrets From GitHub Actions	Different areas that could help leaking secrets from GitHub Actions workflows vulnerable to command injection: Reading files and environment variables Intercepting network/process communication Dumping memory
Reusable workflow is good ... Until you realize your identity is also reusable by anyone	How attackers can exploit OIDC to access sensitive repository data
Mitigating Attack Vectors in GitHub Workflows	An overview of the most common attack vectors on GitHub workflows and recommendations on how to secure them
Typosquatting in GitHub Actions	Post explaining jow typosquatting in GitHub Actions can compromise your workflows and teaching key strategies to protectf rom this risk
How to bypass GitHub’s Branch Protection	Post taking a look at branch protection (protected branches) on GitHub; in particular, whether it's possible for attackers to bypass rules requiring approval to merge pull requests
Optimizing GitHub security at Sendbird: Challenges & key takeaways	The story of the challenges and key improvements to Sendbird's GitHub security posture
Hardening GitHub Actions: Lessons from Recent Attacks	Build resilient GitHub Actions workflows with insights from real attacks, missteps to avoid, and security tips GitHub's docs don't fully cover
GitHub Actions Security: A Guide to Common Risks	This article examines GitHub Actions security risks including secrets management failures, overprivileged tokens, dependency pinning issues, supply chain attacks via compromised actions, script injection, workflow injection through pull requests, artifact poisoning, and self-hosted runner compromise
Artifact Attestations	Introducing Artifact Attestations: Generate and verify signed attestations for anything you make with GitHub Actions Configure GitHub Artifact Attestations for secure cloud-native delivery: Introducing the generally available capability of GitHub Artifact Attestations to secure your cloud-native supply chain packages and images
GitHub Actions Security Checklist for Supply Chain Attacks	A practical GitHub Actions security checklist covering permissions, secrets, OIDC, pull_request_target, SHA-pinned actions, runners, artifacts, and CI/CD supply chain defense

OIDC

Tool	Description
Marco Lancini Identity Federation for CI on AWS	A small Terraform module which automates the setup of OIDC federation between AWS and Github Actions/GitLab CI
auth (GCP)	GitHub Action for authenticating to Google Cloud with GitHub Actions OIDC tokens and Workload Identity Federation
github-oidc-checker	Tool that checks for misconfigured access to Github OIDC from AWS roles and GCP service accounts You can also refer to the companion blog post
github-oidc-utils	A wrapper around GitHub's OIDC API that also inspects the sub claim formats for both the organization or the repository
Avoiding mistakes with AWS OIDC integration conditions	Post exploring some common missteps in securing your AWS OIDC
Improve GitHub Actions OIDC security posture with custom issuer	You can grant developers permission to invoke iam:CreateRole without worrying that an errant role trust policy has opened up access to the entirety of Github.com
Fine-Grained RBAC For GitHub Action Workflows With GitHub OIDC and HashiCorp Vault	DigitalOcean’s approach to securing CI/CD through GitHub Actions, OIDC, and HashiCorp Vault
Configuring Workload Identity Federation for GitHub actions and Terraform Cloud	Workload Identity Federation can be integrated with external providers, such as Gitlab, GitHub actions and Terraform Cloud
Addressed AWS defaults risks: OIDC, Terraform and Anonymous to AdministratorAccess	Preventing anonymous privilege escalation via misconfigured OIDC roles: defensive strategies and AWS's improvements
Octo STS	Octo STS is a GitHub App that acts as a "Security Token Service" (aka STS) for the GitHub API The end of GitHub PATs: You can’t leak what you don’t have
Attacks	No keys attached: Exploring GitHub-to-AWS keyless authentication flaws: While popular, GitHub-to-AWS keyless authentication mechanisms can be insecurely configured Hacking Github AWS integrations again: Another post looking at the perils of unproperly scoping access provided by OIDC

Tools

Tool	Description
dependabot-core	Dependabot's core logic for creating update PRs
attest-build-provenance	Action for generating build provenance attestations for workflow artifacts
Allstar	A GitHub app that provides automated continuous enforcement of security best practices for GitHub projects
policy-bot	A GitHub App that enforces approval policies on pull requests
dco	A GitHub App that enforces the Developer Certificate of Origin (DCO) on pull requests
gordon	A Github app that enforces and validate about.yaml file specifications during pull requests to drive code ownership at scale within an organization Can The Real Codeowners Please Stand Up? Code Provenance at Scale
gitoops	A tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls
lobster-pot	Scans every git push to your Github organisations to find unwanted secrets
reposaur	Audit your GitHub data using custom policies written in Rego
ratchet	A tool for securing CI/CD workflows with version pinning
chain-bench	A tool for auditing your software supply chain stack for security compliance
magic-github-proxy	A stateless GitHub API proxy that allows creation and use of access-limited GitHub API tokens Basically, it's identity and access management for GitHub API tokens
github-analyzer	A tool to check the security settings of Github Organizations
gato	An enumeration and attack tool to evaluate the blast radius of a compromised personal access token within a GitHub organization
Gato-X	A static analysis and exploit toolkit for GitHub Actions
ToBeReviewedBot	GitHub App to watch for PRs merged without a reviewer approving
actions-permissions	GitHub token permissions Monitor and Advisor actions You can also refer to the companion blog post
legitify	Detect and remediate misconfigurations and security risks across all your GitHub and GitLab assets
nord-stream	A tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines
lotp	Living Off The Pipeline tools
github-secrets	Analyzes a given Gitlab repository and searches for dangling or force-pushed commits containing potential secret or interesting information
cleanowners	A GitHub Action to suggest removal of non-organization members from CODEOWNERS files
poutine	A security scanner that detects misconfigurations and vulnerabilities in the build pipelines of a repository
RedFlag	RedFlag uses AI to identify high-risk code changes. Run it in batch mode for release candidate testing or in CI pipelines to flag PRs and add reviewers Introducing RedFlag: Using AI to Scale Addepar's Offensive Security Team
zizmor	A static analysis tool for GitHub Actions
force-push-scanner	Scan for secrets in dangling commits on GitHub using GH Archive data
trajan	A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations Building Bridges, Breaking Pipelines: Introducing Trajan

GitLab

Articles

Article	Description
OIDC	Configure OpenID Connect in AWS to retrieve temporary credentials Configure OpenID Connect between GitLab and AWS (Terraform example)
Attacking GitLab CI/CD via Shared Runners	An attacker who can get their malicious pipeline executing on a runner can steal information for other work executing on the same runner, and subsequently gain access to production systems
The ultimate guide to token management at GitLab	How did we end up needing 16 different types of tokens to secure CI/CD access?

OIDC

Tool	Description
Marco Lancini Identity Federation for CI on AWS	A small Terraform module which automates the setup of OIDC federation between AWS and Github Actions/GitLab CI
OIDC Modules	Terraform modules that help to set up an OIDC integration between GitLab and GCP You can also refer to the companion blog post

Tools

Tool	Description
gitlab-watchman	Monitoring GitLab for sensitive data shared publicly
legitify	Detect and remediate misconfigurations and security risks across all your GitHub and GitLab assets
nord-stream	A tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines
gitlab-secrets	Analyzes a given Gitlab repository and searches for dangling or force-pushed commits containing potential secret or interesting information
poutine	A security scanner that detects misconfigurations and vulnerabilities in the build pipelines of a repository