Harden a CI/CD pipeline by treating it as a privileged production system: it runs code from multiple sources, handles credentials, and may publish software directly to users. Reduce what a compromised job can access, protect workflow changes and third-party code, isolate build workers, and require evidence about dependencies and artifacts before deployment.
Start with the pipeline’s trust boundaries
A pipeline is not one trusted process. A pull request, a dependency, an action or plugin, a runner, and a release job can each introduce code or influence what gets built. Map those sources against the credentials, environments, network destinations, and artifacts they can reach. The key question for each job is: if its code or worker were compromised, what could an attacker read, change, or publish?
As an Amazon Associate I earn from qualifying purchases.
Use that answer to separate untrusted validation from privileged release work. A job that tests an outside contributor’s change should not receive deployment credentials or inherit access to a trusted release environment. A release should consume reviewed source and controlled build inputs rather than silently elevating a less-trusted workflow.
Recommended Free Tools
Reduce the value of stolen credentials
Prefer short-lived workload identity over stored, long-lived cloud credentials when the CI host and cloud provider support it. Restrict tokens to the intended audience, job, resource, and permissions; give them only the access necessary for that task. Limit each secret to the jobs and environments that need it, and avoid exposing secrets to untrusted pull-request code, build logs, or command output.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Separate credentials by purpose. Use distinct identities for tasks such as reading dependencies, publishing an artifact, and deploying it. Do not let a routine test job use a production deployment identity.
- Constrain token scope and lifetime. Check which job can request a token, what audience it is issued for, which resources it can access, and when it expires. Revoke or rotate credentials when exposure is suspected.
- Keep secrets out of untrusted execution. Do not make privileged secrets available to forked or otherwise untrusted changes. Where a workflow needs a secret, gate access on an appropriate trust decision and keep the privileged operation in a separate job.
- Protect the identity path. Review how the CI provider asserts the workflow’s identity and how the cloud provider validates it. Exact settings and labels vary by provider, so use the current documentation for the CI host and identity provider rather than assuming a portable configuration.
NIST IR 8587, published in September 2026, gives implementation guidance for federal agencies and cloud service providers protecting identity tokens, access tokens, and assertions from forgery, theft, and misuse. It reinforces that token security includes how tokens are issued, scoped, protected, and used—not just where a secret is stored.
Protect workflow files and build scripts as code
Workflow definitions, build scripts, and deployment configuration can change what code runs and which credentials it receives. Treat changes to them as security-sensitive code changes, not routine metadata edits.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Require review by designated owners for changes to workflow definitions, build scripts, release configuration, and other files that control privileged jobs.
- Apply branch protection and policy checks so a change cannot bypass the required review path.
- Inspect pull-request triggers and permissions. Ensure untrusted contributions cannot cause a privileged workflow to run with secrets or write access.
- Review changes to workflow permissions, environment protections, and reusable workflows with the same care as changes to application code.
Repository ownership and approval rules are useful only if they cover the files that actually control execution. Identify those files in each repository and verify that the review mechanism applies to them.
Limit risk from actions, plugins, and external services
Third-party actions, plugins, and integrations execute within or influence the build environment. Inventory them, understand the permissions they receive, and assess their source and maintenance before relying on them.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Use immutable revision references where the platform supports them, rather than a movable version label that could later point to different code.
- Review what an integration can read, write, and transmit, and remove integrations that are no longer needed.
- Prefer narrowly scoped permissions for each step or job; avoid granting repository-wide write access simply because one task needs to publish an artifact.
- Track changes to the pinned revision and review updates deliberately, rather than allowing third-party code to change without an approval point.
Pinning helps ensure a workflow uses the revision you reviewed, but it does not establish that the code at that revision is safe. Review and permission limits remain necessary.
Isolate runners and restrict outbound access
A runner can hold credentials and process attacker-controlled code, making it a valuable target. Use isolated workers for sensitive jobs and prefer clean, ephemeral runners that are discarded after the job. Avoid reusing a worker’s filesystem, credentials, caches, or other state across jobs with different trust levels.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Separate untrusted pull-request builds from release and deployment workers.
- Remove persistent credentials and unnecessary tools from the runner image; keep its base image and software maintained.
- Constrain outbound network access to destinations the build actually needs. Broad internet access makes it easier for compromised code to send out secrets or fetch unreviewed inputs.
- Where practical, use vetted dependency sources or controlled mirrors, and allowlist required destinations instead of permitting unrestricted egress.
- Define how runner images, caches, and temporary storage are cleaned up, and check that the cleanup occurs after failures as well as successful runs.
Isolation and egress controls should reflect the job’s role. A dependency-fetching job may need access to approved repositories; a deployment job may need a narrow path to a deployment service. Avoid treating all runner traffic as equally necessary.
Free tools Windows power users keep installed
One-click scans. No signup required.
Control dependencies and the artifacts they produce
Supply-chain security must cover both what enters a build and what leaves it. Acquire dependencies through trustworthy channels, keep an inventory of components, and assess them for known issues and policy violations. Where appropriate, use vetted repositories or mirrors to make dependency sources more consistent and controllable.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Enumerate direct and transitive dependencies so teams can identify what a build includes.
- Scan dependencies and have a defined process for evaluating findings, updating affected components, or documenting an accepted exception.
- Record the build inputs and retain provenance or attestations that help establish how an artifact was produced.
- Use software bills of materials (SBOMs) and other component records to support inventory and downstream review; an SBOM describes components, but does not by itself prove that an artifact is trustworthy.
- Make deployment decisions using evidence about the artifact and its production process, not merely its filename, storage location, or successful build status.
Provenance and attestations are useful only when a consumer can assess their source and meaning. Define which evidence a release or deployment must present and what happens when it is missing or fails validation.
Apply the guidance at the right scope
Three established references address related but distinct parts of the problem. They complement one another; none is a certification or a guarantee that a particular pipeline is secure.
| Guidance | Scope | How to use it |
|---|---|---|
| NIST SP 800-204D, published February 12, 2024 | Strategies for integrating software supply-chain security measures into DevSecOps CI/CD pipelines. | Use it to shape pipeline-level controls and their integration into CI/CD. |
| NIST SP 800-218 SSDF 1.1, published February 3, 2022 | Secure software development practices across the development lifecycle. | Use it to connect pipeline controls to the broader secure-development program. |
| SLSA | Incrementally adoptable supply-chain practices for producers and ways for consumers to evaluate artifacts. | Use it to improve how software is built and to structure consumer decisions about build evidence. |
Choose controls that fit the identity, CI, cloud, and deployment architecture you operate. The guidance does not establish one universally preferred CI vendor or configuration.
Roll out controls in a practical order
- Map access and triggers. For each workflow, identify who or what can start it, what code it runs, which secrets and tokens it can obtain, and what it can publish or deploy.
- Remove unnecessary privilege. Separate test and release identities, limit permissions, scope secrets to specific jobs and environments, and move to short-lived workload identity where supported.
- Secure workflow changes. Identify execution-controlling files, require appropriate review and ownership, and prevent untrusted pull requests from reaching privileged jobs.
- Constrain code and infrastructure inputs. Inventory external actions and integrations, use immutable references where supported, isolate runners, and restrict network egress to required destinations.
- Make build outputs assessable. Inventory and evaluate dependencies, retain provenance or attestations, and define the evidence required before an artifact can be released or deployed.
- Test the boundaries. Check that an untrusted change cannot read a privileged secret, that one job cannot reuse another job’s runner state, and that release permissions are not available to routine validation jobs.
Revisit the map when workflows, integrations, identity settings, runner images, or deployment paths change. A control that was adequate for one trust boundary may not be adequate after the pipeline changes.
What these controls do—and do not—establish
Short-lived identity limits the window and scope of credential misuse; it does not make an overprivileged token harmless. Reviewing and pinning third-party code makes changes more governable; it does not certify that the reviewed code is benign. Runner isolation and network restrictions reduce opportunities for cross-job compromise and exfiltration; they do not replace control over build inputs and outputs. Provenance and SBOMs provide evidence for decisions; teams still need rules for evaluating that evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
