Repository and CI/CD Security
A sequence covering both a repository's own security posture and the pipeline that builds and deploys from it — two categories that are usually reviewed together because a pipeline typically holds more privilege than what it deploys.
- Audience
- Engineers and AppSec practitioners reviewing a repository's access controls, dependency hygiene, and CI/CD configuration.
- Level
- Intermediate
- Depth
- Moderate to long — ten steps, two of them optional product pages at the end.
Prerequisites
- Familiarity with your team's actual CI/CD provider (GitHub Actions, GitLab CI) is helpful context, not a hard requirement.
Learning Objectives
- Assess repository access, secret handling, and dependency provenance systematically rather than ad hoc.
- Understand the specific CWEs behind the most common repository and pipeline findings.
- Leave with a completed interactive review and a forward-looking secure-development plan.
0 of 10 complete (0%)
Progress is saved only in this browser.
Steps
1. Repository Security
OpenCategory
What a repository security assessment covers beyond what an automated scan alone catches.
2. CI/CD Security
OpenCategory
The pipeline is a trust boundary in its own right — this frames why it gets a separate review from the repository itself.
3. Repository Security Assessment Checklist
OpenArticle
A practical checklist for the access-control and ownership questions a scan alone can't answer.
4. CI/CD Security Controls Every Engineering Team Should Have
OpenArticle
The specific controls — fork PR handling, secret scoping, pinned dependencies — that keep a pipeline from being the easiest path to compromise.
5. CWE-798: Use of Hard-coded Credentials
OpenReference
The CWE behind the most common repository finding: a credential committed where it shouldn't be.
6. CWE-1104: Use of Unmaintained Third-Party Components
OpenReference
The weakness behind supply-chain risk from a dependency that's still functional but no longer maintained.
7. Repository Security Review
OpenDecision Center
Apply everything above as a structured, interactive review across eight categories.
8. Secure SDLC Planner
OpenDecision Center
Turn the review's findings into a forward-looking plan sized to your team and release cadence.
9. Repository Security Scanner
OptionalProduct
Automate the dependency and secret-detection parts of this review on a real repository.
10. CI/CD Security Scanner
OptionalProduct
Run the same scanning automatically inside your actual pipeline.
Related Learning Paths
Secure SDLC Planning
For engineers and leads designing or refreshing a secure development process — grounded in the ASVS verification standard and existing repository/CI/CD guidance rather than a generic checklist.
Vulnerability Prioritization
A focused sequence on the specific question of what to fix first — the standards involved, why severity alone is an incomplete answer, and a tool to apply the reasoning to a real finding.