A CI/CD pipeline holds the keys to production, which makes it a target. Verizon's 2025 DBIR found third-party involvement in 30% of breaches, double the previous year, and in March 2025 CISA warned that a widely used GitHub Action had been compromised in a way that could expose secrets. This guide covers the OWASP CI/CD risks and the GitHub settings that address them.
Why the pipeline is a high-value target
Your CI system can read source code, pull secrets, push images and deploy to production. Anyone who controls a step in it can often do the same. That is why the OWASP Top 10:2025 now names Software Supply Chain Failures as A03, widening the old outdated-components category to cover build systems and third-party tooling. Startups are exposed because they move fast with many third-party actions, broad tokens and few reviewers. The good news is that most protections are configuration, not new products.
The OWASP Top 10 CI/CD Security Risks
OWASP released this list in 2022, with the stable v1.0 following in October that year. The table pairs each risk with a GitHub control a small team can switch on. Most of the controls are settings rather than paid tools, which makes this list a practical starting audit.
| Risk | What it means | GitHub control |
|---|---|---|
| CICD-SEC-1 Insufficient Flow Control | Code reaches production without review | Branch protection, required reviews and checks |
| CICD-SEC-2 Inadequate Identity and Access Management | Too many people or bots with too much access | Least-privilege teams, MFA, remove stale accounts |
| CICD-SEC-3 Dependency Chain Abuse | Malicious or confused packages pulled into builds | Dependency review and lockfiles |
| CICD-SEC-4 Poisoned Pipeline Execution | Attacker-controlled code runs in your pipeline | Avoid running untrusted PR code with secrets |
| CICD-SEC-5 Insufficient Pipeline-Based Access Controls | Pipelines can reach more than they need | Scoped GITHUB_TOKEN, environment protection |
| CICD-SEC-6 Insufficient Credential Hygiene | Long-lived or leaked pipeline secrets | OIDC, secret scanning, push protection |
| CICD-SEC-7 Insecure System Configuration | Weak runner or CI settings | Hardened, isolated runners |
| CICD-SEC-8 Ungoverned Usage of 3rd Party Services | Unvetted apps and actions with access | Allowlist actions and review installed apps |
| CICD-SEC-9 Improper Artifact Integrity Validation | Builds can be swapped or tampered with | Pin by SHA, sign and verify artifacts |
| CICD-SEC-10 Insufficient Logging and Visibility | Pipeline abuse goes unnoticed | Audit log review and alerts |
Lessons from the tj-actions compromise
In March 2025 the GitHub Action tj-actions/changed-files, used to detect changed files in pull requests, was compromised. CISA said the compromise could expose secrets including access keys, GitHub personal access tokens, npm tokens and private RSA keys, assigned it CVE-2025-30066 and added it to the Known Exploited Vulnerabilities Catalog. The fix shipped in version 46.0.1.
The lesson is that a tag such as v46 is a pointer the action's owner, or an attacker, can move. Teams pinned to a reviewed commit SHA were insulated from silent changes. Any team that ran the affected versions needed to treat secrets visible to those workflows as exposed and rotate them.
Pin, review and allowlist third-party actions
GitHub's own guidance states that pinning an action to a full-length commit SHA is currently the only way to use it as an immutable release. Verify the SHA comes from the action's own repository and not a fork, and audit the source of actions that touch secrets.
Pinning has a trade-off: GitHub notes Dependabot alerts do not cover actions pinned to SHAs, so use Dependabot version updates to raise pull requests when new releases appear, and review each one. At organisation level, restrict which actions may run to an allowlist.
Limit tokens and replace stored cloud keys
Set the default GITHUB_TOKEN permission to read-only for repository contents and grant extra permissions per job only where needed. GitHub also reminds teams that anyone with write access to a repository can read all its secrets, so scope each secret to the smallest set of repositories and environments.
Replace long-lived cloud access keys with OpenID Connect, which GitHub and OWASP both recommend. The workflow requests a short-lived token for one job, so there is no static key to leak. GitGuardian's finding that 70% of secrets leaked in 2022 were still valid shows why short lifetimes matter.
Untrusted input and risky triggers
Two patterns cause many pipeline compromises. The first is script injection: inserting a pull request title or branch name straight into an inline shell step. GitHub advises passing such values through an intermediate environment variable or an action argument instead.
The second is pull_request_target and workflow_run, which run with access to secrets and write permissions. GitHub recommends avoiding pull_request_target unless you need it and never checking out untrusted pull request code in those workflows. Self-hosted runners need extra care, because untrusted workflow code can persistently compromise them.
A GitHub hardening checklist for startups
These settings take a few hours across a small organisation and close the most common gaps. Apply them at organisation level where GitHub allows it, so new repositories inherit them, and record any exceptions with a reason and an owner.
- Require MFA for every organisation member
- Protect the main branch: reviews, status checks, no force pushes
- Add .github/workflows to CODEOWNERS so workflow changes need approval
- Set GITHUB_TOKEN to read-only by default
- Pin third-party actions to full commit SHAs and allowlist them
- Use OIDC for cloud deploys; protect production environments with reviewers
- Enable secret scanning and push protection; free on public repositories
- Review installed GitHub Apps and personal access tokens each quarter
Budget and next steps
Most of the checklist is free. For private repositories, GitHub sells Secret Protection at USD 19 and Code Security at USD 30 per active committer per month, available to Team plans since April 2025. Start with the free configuration work, then decide whether paid scanning fits your risk. XDQ Labs reviews and hardens CI/CD pipelines for teams that own them, then verifies the fixes, as part of its AI security engineering services.
Frequently asked questions
Why should GitHub Actions be pinned to a commit SHA?
Tags and branches can be moved, so a compromised action can change underneath you, as the 2025 tj-actions incident showed. GitHub's documentation says pinning to a full-length commit SHA is currently the only way to use an action as an immutable release. Use Dependabot to propose reviewed updates.
What is poisoned pipeline execution?
It is CICD-SEC-4 in OWASP's CI/CD risk list. An attacker gets their own commands to run inside your pipeline, for example by changing a build script in a pull request that a privileged workflow then executes. Avoid running untrusted code in workflows with secrets or write access.
Is pull_request_target safe to use?
It can be risky. Workflows triggered by pull_request_target run with access to secrets and write permissions. GitHub recommends avoiding it unless you need privileged context, and never checking out or running untrusted pull request code in such workflows.
How do I stop secrets leaking from CI/CD?
Use OIDC so pipelines get short-lived cloud tokens instead of stored keys, scope remaining secrets to specific environments, set GITHUB_TOKEN to read-only by default, and enable secret scanning with push protection. Do not store JSON blobs as one secret, because log redaction relies on exact matches.
Sources
- OWASP Top 10 CI/CD Security Risks, OWASP Foundation, 2022
- Secure use reference for GitHub Actions, GitHub Docs, 2026
- Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066, CISA, 2025
- Verizon 2025 Data Breach Investigations Report: news release, Verizon, 2025
- The State of Secrets Sprawl 2025, GitGuardian, 2025
- Introducing GitHub Secret Protection and GitHub Code Security, GitHub Changelog, 2025
- OWASP Top 10:2025 Introduction, OWASP Foundation, 2025
- Secrets Management Cheat Sheet, OWASP Cheat Sheet Series, 2025
- Push protection is generally available, and free for all public repositories, GitHub Blog, 2023
