OWASP Top 10 CI/CD Security Risks

This skill encodes the OWASP Top 10 CI/CD Security Risks for secure pipeline design and review. References are loaded per risk. Based on OWASP Top 10 CI/CD Security Risks 2022.

When to Read Which Reference

Risk	Read
CICD-SEC-1 Insufficient Flow Control	references/cicd-sec-1-flow-control.md
CICD-SEC-2 Inadequate IAM	references/cicd-sec-2-iam.md
CICD-SEC-3 Dependency Chain Abuse	references/cicd-sec-3-dependency-chain-abuse.md
CICD-SEC-4 Poisoned Pipeline Execution	references/cicd-sec-4-poisoned-pipeline-execution.md
CICD-SEC-5 Insufficient PBAC	references/cicd-sec-5-pbac.md
CICD-SEC-6 Insufficient Credential Hygiene	references/cicd-sec-6-credential-hygiene.md
CICD-SEC-7 Insecure System Configuration	references/cicd-sec-7-insecure-system-config.md
CICD-SEC-8 Ungoverned 3rd Party Services	references/cicd-sec-8-third-party-services.md
CICD-SEC-9 Improper Artifact Integrity Validation	references/cicd-sec-9-artifact-integrity.md
CICD-SEC-10 Insufficient Logging and Visibility	references/cicd-sec-10-logging-visibility.md

Quick Patterns

• Enforce approval and branching for pipeline execution; apply least-privilege IAM. Verify dependency and artifact integrity; secure credentials; audit third-party usage; enable logging and alerting.

Quick Reference / Examples

Task	Approach
Protect main branch	Require PR reviews, signed commits, branch protection. See CICD-SEC-1.
Secure pipeline IAM	Least privilege, short-lived tokens, no shared creds. See CICD-SEC-2.
Verify dependencies	Lock versions, audit, verify checksums. See CICD-SEC-3.
Protect credentials	Use secrets manager, rotate, never log. See CICD-SEC-6.
Sign artifacts	Sign images/packages, verify before deploy. See CICD-SEC-9.

Safe - GitHub branch protection:

# .github/settings.yml (or repo settings)
branches:
  - name: main
    protection:
      required_pull_request_reviews:
        required_approving_review_count: 1
      required_status_checks:
        strict: true

Safe - short-lived OIDC credentials (GitHub Actions):

permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
      aws-region: us-east-1

Unsafe - long-lived secrets:

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY }}  # Prefer OIDC over static keys

Workflow

Load the reference for the risk you are addressing. See OWASP Top 10 CI/CD Security Risks for the official list.