97 Things Every Application Security Professional Should Know

Chapter 53. Introduction to CI/CD Pipelines and Associated Risks

Tyler Young

Continuous integration and continuous delivery (CI/CD) pipelines are an essential part of modern software development processes. They provide a streamlined way for development teams to manage code changes, automate builds and testing, and deploy changes quickly and efficiently. However, CI/CD pipelines also present unique risks and challenges to the security of your software and infrastructure.

The following are notable risks of CI/CD pipelines:

Code injection

One of the most significant risks associated with CI/CD pipelines is the possibility of code injection. Attackers can exploit vulnerabilities in your pipeline to inject malicious code into your software, potentially compromising the security of your systems and data. This risk becomes more significant when companies leverage open source software libraries, as vulnerabilities can be identified and exploited at scale.

Secret/credential hygiene

CI/CD pipelines often require access to sensitive credentials, such as API keys, database passwords, or other critical authentication tokens. If these credentials are not adequately secured, they can be easily exposed to threat actors, who can then use them to access systems and data. While this isn’t unique to CI/CD security and is a persistent risk to AppSec in general, any time you are deploying automated ...