Description
The pipeline step that downloads and installs dependencies has no access to deployment credentials, cloud credentials, signing keys or publish tokens. Those are only given to later steps that need them.
Rationale
Install-time code, and test code from dependencies, run with whatever the environment holds. Separating installation from secrets limits what a malicious package can steal.
Impact
Pipelines may need to be split into several jobs or steps with different secrets.
Audit
- Review the environment of install steps in each pipeline.
- Check that no secret other than read-only registry access is available.
Automated: every check must pass. Scanners report each check by its id.
postmortem
GitHub Actions install steps vs secrets in their env; other CI by hand
command: postmortem harden --json
control: CB-DEP-CI-001
coverage: partial
Remediation
- Move secrets to the steps that need them.
- Split installation and deployment into separate jobs if secrets are job-wide.
References
- OWASP Top 10 CI/CD Security Risks OWASP, guide, accessed 2026-10-16
- SLSA specification v1.0 OpenSSF, standard, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-6 | related | |
| NIST SP 800-53 Rev. 55.1.1 | SA-15 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| MITRE ATT&CK | T1195.001 | |
| MITRE ATT&CK | T1552 |
Related controls
- related
CB-DEP-EXEC-001Block install-time scripts except for an allowlist - related
CB-DEP-CI-002Use read-only registry credentials in pipelines
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |