Poisoned Pipeline / Mitigations / M1121
M1121
Enable git hooks to find source code related issues early
Enable git hooks to automate the scanning of source code before it is published via git commits.
All Git implementations include a hooks directory in the .git base directory.
In that directory are several git automations called "hooks".
These hooks will automatically run scripts when certain actions happen.
The best example of this is the pre-commit hook that runs before a git commit is successful.
If the script has actions inside it to run things like software composition (SCA) or static analysis tooling (SAST), then those tests must pass before the commit will succeed.
Applies to
- T0112 Compromised token