Poisoned Pipeline / Mitigations / M1480

M1480

Limit the privileges of the runner

Restrict the permissions of the self-hosted runner to the minimum necessary for it to run the CI/CD pipelines.
This can help prevent an attacker from using the runner to access sensitive data or execute malicious code.

Applies to

• T0148 Scheduled tasks on self hosted runner

References

• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners