Spend five minutes on each of six questions: who can change the pipeline, what credentials it holds, what third-party code it runs, where it runs, what it produces, and what is logged. Write down each answer and each gap. The goal is a short fix list, not a full audit.
Minutes 0 to 5: who can change it
Open the repository settings. Check branch protection on branches that deploy, and who can bypass it. OWASP's flow control guidance says accounts that can push unreviewed code should not be able to trigger deployment pipelines for that repository. Check who owns the workflow or pipeline files and whether a code owner must approve changes.
Minutes 5 to 10: what credentials it holds
List every secret the pipeline can read. Note which ones are long-lived. Check the default permissions of the built-in token: GitHub recommends read-only for repository contents by default, with extra permissions granted per job. Check whether production credentials sit behind an environment with required reviewers.
Minutes 10 to 15: what it runs
List every third-party action, plugin, template or script. On GitHub, check whether they are pinned to full commit SHAs. For GitLab includes, check where shared files live and which ref you reference. For Jenkins, check the plugin list for anything unmaintained.
Minutes 15 to 20: where it runs
Check the runners. Are they ephemeral? Do untrusted builds, such as those from forks, share a runner with deploy jobs? On Jenkins, is the built-in node set to 0 executors? Does any job use privileged containers or a shared Docker socket?
Minutes 20 to 25: what it produces
Check whether artifacts are built once and referenced by digest, whether they are signed, and whether you generate an SBOM. Check whether a dependency scan runs on every pull request, and whether a skipped workflow could leave a required check green or pending.
Minutes 25 to 30: what is logged
Confirm you can answer: who changed the pipeline, what ran, which secrets were used, what was deployed. OWASP lists insufficient logging and visibility as its own risk.
Score it
| Area | Covered | Partly | Gap |
|---|---|---|---|
| Change control | |||
| Credentials | |||
| Third-party code | |||
| Runners | |||
| Artifacts | |||
| Logging |
Pick the top three gaps, assign an owner each, and put the date to re-check in the calendar.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings get an owner and a status, which is the same discipline your fix list needs.
Quick check
Which gap should I fix first?
The one that lets a single account reach production without review, usually branch protection and bypass rights.
How often should I repeat this?
Quarterly, and after any change of CI platform or any pipeline incident.
Safeguard covers dependency and SBOM scanning, policies and gates, and compliance evidence automation for the artifacts and pull requests around your pipeline. Run the free scan to cover the dependency part of step four.
Sources
- OWASP CICD-SEC-1: Insufficient Flow Control Mechanisms
- OWASP Top 10 CI/CD Security Risks
- GitHub Docs: Secure use reference
Last reviewed: 19 October 2026.
