Poisoned Pipeline / Techniques / T0189
Secrets in configuration files
Secrets Hygiene CI/CD Posture
It is a very common mistake for developers to keep secrets in configuration files, these can include user credentials, private keys, api keys etc...
Those files are usually the first place where adversaries search for such information.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1120 Store credentials in vault
- M1890 Encrypt secrets
Detections
- D1120 Implement source code scanning for credentials and tokens
Observed in incidents (2)
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- Brevo Cloudflare Worker ClickFix