OWASP CICD-SEC-2, Inadequate Identity and Access Management, is the risk that the many human and machine identities across source control, CI and deployment are poorly managed, so compromising almost any account gives broad power. Fix it by mapping every identity, federating to one identity provider, trimming permissions and expiring access.
What does the risk look like?
OWASP's definition ties the risk to the difficulty of managing the vast number of identities spread across the engineering ecosystem, from source control to deployment. Each system offers several ways in: passwords, personal access tokens, marketplace apps, OAuth applications, plugins, SSH keys. Each may have its own provisioning, policy and authorization model.
OWASP adds a candid observation: the average user account in a source control or CI system is highly permissive, because these systems have not traditionally been a security team's focus, and engineers need the flexibility to change code and infrastructure.
What are the specific weaknesses?
OWASP lists seven patterns, and most organizations recognize several.
- Overly permissive identities. Humans and apps with access to more repositories or actions than they need.
- Stale identities. People and systems that no longer need access but were never deprovisioned in every CI/CD system.
- Local identities. Accounts created inside a tool instead of through a central identity provider, which makes consistent password, lockout and MFA policy and offboarding hard.
- External identities. Employees registered with an email domain the company does not control, so account security depends on an outside provider.
- External collaborators. Their security level is derived from their own work environment.
- Self-registered identities. Systems where a valid domain address is enough to sign up, and the default permissions are anything above none.
- Shared identities. One credential used by several people or by people and automation, which widens exposure and ruins accountability in an investigation.
Why is this impact so large?
OWASP's impact statement is worth quoting in spirit: with hundreds or thousands of identities and common over-permissioning, compromising nearly any account on any system could grant powerful capabilities and serve as a path into production. The pipeline sits between code and production, so whoever holds a pipeline identity holds a bridge.
A constructed example
A company has 60 engineers, a source control platform, a CI service, a registry and a deployment tool. An audit finds that two former contractors still have active accounts in the CI service, which was never connected to the company's identity provider. A shared "deploy-bot" account with a password in a wiki page is used by three teams. And a personal access token created by a departed engineer still has write access to every repository. Any one of these is a way to ship code. All three came from systems being added one at a time without an identity review. This scenario is invented.
What does OWASP recommend?
Condensed from the recommendations:
- Continuously map all identities across all systems, recording each identity's provider, granted permissions and permissions actually used. Include programmatic access.
- Remove permissions that are not needed for ongoing work.
- Set an acceptable inactivity period and disable accounts that pass it.
- Avoid local accounts. Manage identities through a central identity provider. Where local accounts exist, disable the unneeded ones and match policy.
- Continuously map external collaborators and apply least privilege.
- Grant access with an expiry date where possible, for humans and machines.
- Avoid default permissions above none for new or self-registered users.
How to check or apply this
- Export the user and token list from each CI/CD system and compare them with the HR roster.
- Count local accounts and accounts with non-company email domains.
- Find shared credentials by looking for generic names and for tokens used from several places.
- Rank identities by what they can reach, and review the top ones first.
- Replace long-lived tokens with short-lived credentials issued per job where your platforms support it.
- Turn on single sign-on and MFA for each system, and disable self-registration.
- Put the review on a calendar. Identity drift returns with each new tool.
Safeguard includes policies and gates that can act on pipeline findings, but identity hygiene in your source control and CI systems is still configured in those systems and your identity provider.
Quick check
Is a service account an identity under this risk?
Yes. OWASP explicitly covers both human and programmatic accounts, including tokens, apps and keys.
What is the quickest fix with the biggest effect?
Removing stale accounts and tokens, since they are real access that nobody is using or watching.
Sources
Last reviewed: 18 October 2026.
