Extra Credit

OWASP Top 10 CI/CD Security Risks

Security OWASP
Official docs Learn it on your Mac

Official docs outline

10 sections
  1. CICD-SEC-1 Insufficient Flow Control Mechanisms

    Branch protection, required reviews and gated deployments.

  2. CICD-SEC-2 Inadequate Identity and Access Management

    Identity sprawl, stale accounts and weak CI access control.

  3. CICD-SEC-3 Dependency Chain Abuse

    Dependency confusion, typosquatting and malicious packages.

  4. CICD-SEC-4 Poisoned Pipeline Execution

    Direct, indirect and public PPE through modified pipeline definitions.

  5. CICD-SEC-5 Insufficient PBAC

    Pipeline-based access controls and over-privileged jobs.

  6. CICD-SEC-6 Insufficient Credential Hygiene

    Secrets in code and logs, long-lived credentials and scoping.

  7. CICD-SEC-7 Insecure System Configuration

    Hardening of CI/CD systems, runners and patching.

  8. CICD-SEC-8 Ungoverned Usage of 3rd Party Services

    Third-party integrations, apps and actions with excessive permissions.

  9. CICD-SEC-9 Improper Artifact Integrity Validation

    Artifact signing, verification and provenance.

  10. CICD-SEC-10 Insufficient Logging and Visibility

    Audit logs and detection across the pipeline.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

All 33