CI/CD Pipeline Secrets Exposure

Detects secrets hardcoded in CI/CD configuration files (GitLab CI, GitHub Actions, CircleCI, Jenkins).

zakirkun Updated

File contents

CI/CD Pipeline Secrets Exposure

Overview

CI/CD configuration files committed to version control often contain hardcoded API keys, tokens, or passwords. These are frequently visible in:

  • Public repositories
  • Git history (even after removal)
  • Third-party services that access the repository

Remediation

  • Use CI/CD secret management (GitHub Secrets, GitLab CI Variables, CircleCI Contexts)
  • Reference secrets as ${{ secrets.MY_SECRET }} or $MY_VAR
  • Scan git history with tools like trufflehog or gitleaks

zakirkun/ice-tea/tree/main/skills/devops/ci-cd-secrets commit 58f1c8b68a

Frequently asked questions

npx skillmds@latest add zakirkun/ci-cd-pipeline-secrets-exposure