Poisoned Pipeline / Mitigations / M1120

M1120

Store credentials in vault

Sensitive data like credentials and API tokens should not be stored directly in code.
Modern applications talk to many third-party APIs, SaaS solutions and other dependencies.
This integration usually requires an API token, username & password credential or other similar variable.
Sometimes these sensitive credentials include database host strings or hostnames.
All of these credentials should not be stored directly in code.
Software engineers often don't understand the consequences of embedding these credentials in code.
This is especially true for Javascript applications that run client side as these credentials are often visible by inspecting the Javascript files running in the local browser

Applies to

• T0210 Poison AI coding-agent config or workspace
• T0112 Compromised token
• T0183 Harvesting short-lived token
• T0208 Compromise code-signing identity
• T0147 Scan public CI/CD configurations for secrets and vulnerable actions
• T0140 Harvest tokens from environment variables
• T0202 Inadequate CI/CD workflow permissions
• T0184 Harvesting sensitive information from files
• T0189 Secrets in configuration files
• T0163 Runtime leakage of password
• T0130 Harvest secrets from logs
• T0103 Scan public artifacts for secrets
• T0162 Passwords in CI/CD logs
• T0193 Sensitive information in environment variables
• T0122 Vulnerability in third-party CI/CD actions
• T0200 Proprietary data stolen
• T0213 Orchestrate AI-agent fleet as the intrusion workforce

References

• https://support.google.com/googleapi/answer/6310037?hl=en
• https://learn.microsoft.com/en-us/azure/developer/github/github-key-vault
• https://docs.github.com/en/actions/security-guides/encrypted-secrets
• https://aws.amazon.com/blogs/mt/use-parameter-store-to-securely-access-secrets-and-config-data-in-aws-codedeploy/
• https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/