Secrets in CI/CD Pipelines

⚡ TL;DR: Long-lived CI credentials are a top breach vector, so stop storing secrets at all. Swap stored keys for short-lived, scoped, keyless OIDC auth, keep secrets out of logs and forked PRs, and scan for leaks before attackers find them. Contents A token in a log gave away production The principle: don't store a secret at all The picture: OIDC... Weiterlesen: Secrets in CI/CD Pipelines