Description
Credentials used to download packages in pipelines can only read. Publishing uses separate, short-lived credentials limited to the release job.
Rationale
A stolen read-write token lets an attacker publish a malicious version of the organization's own packages, turning one compromise into many.
Impact
Separate credentials must be managed for publishing.
Audit
- List registry credentials available to pipelines.
- Check that install steps only have read access.
Remediation
- Create read-only credentials for installs.
- Restrict publish credentials to the release job, preferably short-lived and issued per run.
References
- OWASP Top 10 CI/CD Security Risks OWASP, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-6 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| MITRE ATT&CK | T1195.001 | |
| MITRE ATT&CK | T1195.002 |
Related controls
- related
CB-DEP-CI-001Install dependencies in a step without secrets
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |