CICD-SEC-6, insufficient credential hygiene, is the OWASP Top 10 CI/CD risk for secrets handled badly in build and deploy systems: committed to repositories, printed in logs, baked into image layers, over permissioned or never rotated. Fix it with short lived credentials, narrow scopes, secret scanning and rotation.
Why does CI/CD concentrate credentials?
A pipeline touches everything. It pulls from the source repository, writes to artifact storage, signs releases and deploys to production. That means one pipeline can hold more access than any single engineer. OWASP notes that credentials in these environments appear in many contexts and are managed by many methods, which creates a large potential for insecure use, and that attackers actively seek them out.
What are the failure modes?
OWASP lists five flaws.
Credentials in code. A key pushed to a branch is visible to everyone with read access. Deleting it later does not help, because it stays in commit history.
Insecure use in build and deploy. Questions to ask: which pipeline uses which credential, can each pipeline reach only what it needs, and can unreviewed code flowing through the pipeline read it?
Credentials in container image layers. A secret needed only to build an image can persist in a layer that anyone who can pull the image can read.
Credentials in console output. Pipelines print secrets deliberately or by accident, and logs can flow into logging systems, widening exposure.
Unrotated credentials. Deploy keys often follow "if it isn't broken, don't fix it" and stay valid for years while the number of people and artifacts holding them grows.
Constructed example: the build argument
A team builds a container image that needs a private package token. An engineer passes the token as a build argument, and the final image goes to a registry that several contractors can read. Nobody notices that the image history shows the argument value. A contractor's laptop is compromised, and the token, which could publish to the company's package registry, is used to push a tampered package.
Three of OWASP's flaws combined: credentials in an image layer, an overly broad token, and no rotation. Fixing any one would have shrunk the incident.
What do the recommendations say?
OWASP's guidance reads like a checklist.
- Continuously map credentials across systems, from code to deployment.
- Apply least privilege to each credential, and do not share one across contexts.
- Prefer temporary credentials over static ones, and rotate static ones on a schedule while detecting stale ones.
- Constrain credential use to predetermined conditions such as source IP or identity, so stolen credentials are useless elsewhere.
- Detect secrets in repositories with an IDE plugin, scanning on every push, and periodic scans of history.
- Scope CI/CD secrets so each pipeline and step gets only what it requires.
- Mask secrets in console output, and clean old logs.
- Verify secrets are removed from artifacts such as image layers, binaries and Helm charts.
What replaces long lived keys?
Many CI platforms and cloud providers support federated identity, where the pipeline proves who it is with a short lived signed token and exchanges it for a temporary credential. No stored key exists to leak. Where that is not possible, use a secrets manager, inject values at run time and keep them out of build arguments.
Safeguard's secrets scanning covers repositories and history, and its policies and gates can stop a pull request that introduces a credential. Used alongside the controls above, it addresses the first and fourth failure modes directly.
How to check or apply this
- Inventory every credential used by pipelines: owner, scope, age and where it is stored.
- Revoke and replace any credential that is older than your rotation limit or shared across pipelines.
- Switch to federated or short lived credentials for cloud deployment where supported.
- Turn on secret scanning on push and run a historical scan of all repositories.
- Review image build steps. Use build secrets that do not persist in layers, and inspect final images.
- Enable log masking, and search past logs for exposed values.
- Restrict who can modify pipeline definitions, since changed pipeline code can read secrets.
Quick check
If I delete a leaked key from a repository, is the problem fixed?
No. It stays in commit history. Revoke and replace the credential, then clean up the exposure.
Why prefer temporary credentials?
They expire on their own, so a stolen one is valuable for minutes rather than years.
Sources
- OWASP Top 10 CI/CD Security Risks, CICD-SEC-6: Insufficient Credential Hygiene
- NIST SP 800-218, Secure Software Development Framework
Last reviewed: 18 October 2026.
