# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-CI-001
title: Install dependencies in a step without secrets
finding:
  title: Dependencies are installed in an environment that holds secrets
  description: A malicious package can read deploy keys, cloud credentials and publish tokens as soon as it is installed.
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: partial
tags: [ci, secrets]
description: |
  The pipeline step that downloads and installs dependencies has no access to deployment credentials, cloud credentials, signing keys or publish tokens. Those are only given to later steps that need them.
rationale: |
  Install-time code, and test code from dependencies, run with whatever the environment holds. Separating installation from secrets limits what a malicious package can steal.
impact: |
  Pipelines may need to be split into several jobs or steps with different secrets.
audit:
  manual: |
    1. Review the environment of install steps in each pipeline.
    2. Check that no secret other than read-only registry access is available.
  checks:
    - id: postmortem
      engine: postmortem
      description: "GitHub Actions install steps vs secrets in their env; other CI by hand"
      spec:
        command: postmortem harden --json
        control: CB-DEP-CI-001
        coverage: partial
remediation:
  manual: |
    1. Move secrets to the steps that need them.
    2. Split installation and deployment into separate jobs if secrets are job-wide.
references:
  - title: OWASP Top 10 CI/CD Security Risks
    url: https://owasp.org/www-project-top-10-ci-cd-security-risks/
    publisher: OWASP
    kind: guide
    accessed: 2026-10-16
  - title: SLSA specification v1.0
    url: https://slsa.dev/spec/v1.0/
    publisher: OpenSSF
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: AC-6
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SA-15
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: mitre-attack
    id: T1552
related_controls:
  - id: CB-DEP-EXEC-001
    type: related
  - id: CB-DEP-CI-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16