CI/CD Pipeline Secrets Exposure
Overview
CI/CD configuration files committed to version control often contain hardcoded API keys, tokens, or passwords. These are frequently visible in:
- Public repositories
- Git history (even after removal)
- Third-party services that access the repository
Remediation
- Use CI/CD secret management (GitHub Secrets, GitLab CI Variables, CircleCI Contexts)
- Reference secrets as
${{ secrets.MY_SECRET }}or$MY_VAR - Scan git history with tools like
trufflehogorgitleaks