CI/CD Security.

The set of controls protecting continuous integration and continuous delivery pipelines from compromise, code injection, secret leakage, and unauthorized deployments. It belongs to the Application Security category of cybersecurity.

The set of controls protecting continuous integration and continuous delivery pipelines from compromise, code injection, secret leakage, and unauthorized deployments.

CI/CD systems sit between source code and production, so a compromise there gives attackers near-arbitrary control over what runs. CI/CD security covers identity (least-privilege OIDC tokens, federated identities, no long-lived deployment keys), pipeline configuration (pinned runners, signed build steps, isolated jobs), secret management (vaults, JIT credentials, secret scanning, masked logs), source integrity (signed commits, branch protection, mandatory reviews), supply-chain controls (SBOM, SLSA, signed artifacts), and runtime protection of the controllers themselves. Notable incidents like SolarWinds, Codecov, and the SCMKit research highlighted CI/CD as a high-value target. Frameworks include OWASP CI/CD Top 10 and CISA guidance on securing the software supply chain.

Defences for CI/CD Security typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Pipeline security, Build pipeline security.