Discover localized out-of-band deployments

CI/CD Posture Open Source Security SCM Posture Artifact Security

Attackers look for evidence of an out-of-band or "localized" deployment
path they can hijack — a package.json script that SSHes to production,
a Makefile target that publishes without the main pipeline, a leftover
deploy.sh, or a personal access token used by a developer laptop.
These paths are rarely covered by the same reviews, SBOMs, or admission
controls as the official CI/CD system, which makes them high-value
reconnaissance targets.

Where this idea came from

Standard or guidance

This catalogue, from upstream issue #23; cited OWASP Top 10 CI/CD.

Mitigations

M1503 Implement SCA analysis
M1720 Implement regular patches and updates
M1220 Use only trusted third-party Github actions from reputable sources

Detections

D1500 Configure monitoring of used artifacts and open-source libraries
D1510 Implement Intrusion Detection System and anti-malware

Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.

References

https://owasp.org/www-project-top-10-ci-cd-security-risks/