# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-CI-002
title: Use read-only registry credentials in pipelines
finding:
  title: Pipelines hold registry credentials that can publish packages
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: partial
tags: [ci, secrets, registry]
description: |
  Credentials used to download packages in pipelines can only read. Publishing uses separate, short-lived credentials limited to the release job.
rationale: |
  A stolen read-write token lets an attacker publish a malicious version of the organization's own packages, turning one compromise into many.
impact: |
  Separate credentials must be managed for publishing.
audit:
  manual: |
    1. List registry credentials available to pipelines.
    2. Check that install steps only have read access.
remediation:
  manual: |
    1. Create read-only credentials for installs.
    2. Restrict publish credentials to the release job, preferably short-lived and issued per run.
references:
  - title: OWASP Top 10 CI/CD Security Risks
    url: https://owasp.org/www-project-top-10-ci-cd-security-risks/
    publisher: OWASP
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: AC-6
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: mitre-attack
    id: T1195.002
related_controls:
  - id: CB-DEP-CI-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16