Description
Build and install steps can only reach the organization's registries and the services the build requires. Other outbound traffic is blocked and logged.
Rationale
Blocks malicious install code from exfiltrating secrets or downloading a second stage, and stops builds from silently fetching unvetted code.
Impact
Builds that download from the internet break until their sources are proxied.
Audit
- From a build environment, try to reach an arbitrary internet host: it must fail.
- Check that blocked attempts are logged.
Automated: every check must pass. Scanners report each check by its id.
postmortem
harden-runner egress policy; network-level egress is not visible
command: postmortem harden --json
control: CB-DEP-CI-003
coverage: partial
Remediation
- Apply an egress allowlist to build environments, limited to approved registries and required services.
References
- SLSA specification v1.0 OpenSSF, standard, accessed 2026-10-16
- OWASP Top 10 CI/CD Security Risks OWASP, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SC-7 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| MITRE ATT&CK | T1041 |
Related controls
- related
CB-DEP-SRC-001Resolve all packages through an organization-controlled registry
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |