How to Secure Code Repositories, CI/CD Pipelines, and Software Artifacts
Summary
Developer infrastructure can expose software supply chains to unauthorized access and malicious changes. The article outlines repository, pipeline, identity, and registry controls, plus monitoring for suspicious activity.
Key points
- The article recommends treating version control systems, CI/CD pipelines, and artifact registries as security-critical infrastructure.
- Suggested repository controls include requiring peer reviews, blocking force pushes to default branches, and limiting self-hosted runners to authorized repositories.
- It highlights risks from external collaborators, inactive users with admin rights, and overprivileged service accounts or third-party GitHub Apps.
- The article cites the 2024 Ultralytics PyPI attack, in which attackers reportedly compromised a maintainer’s repository and published a backdoored package that stole credentials and accessed cloud services.
- It recommends correlating source-control audit logs, CI/CD activity, and runtime events to identify suspicious cloning, removed branch protections, privilege escalation, or unusual runner activity.
- It cites a December 2024 compromise of Kong’s DockerHub registry account, which was used to publish a malicious cryptomining image affecting Kong Ingress Controller version 3.4.0.
- Registry defenses include detecting exposed credentials and unrestricted image overwrites, and signing images during builds and verifying signatures before Kubernetes deployment.
Article Details
- Defense Focus
- Continuously assess developer infrastructure posture and detect threats across identities, source-code repositories, CI/CD pipelines, artifact registries, cloud environments, and runtime activity.
- Detection Methods
- Map developer and service-account identities across version control systems, identity providers, and cloud accounts to identify risky access and excessive permissions.
- Apply prebuilt security rules to repository configuration, branch protections, pipeline settings, and artifact registries.
- Correlate source code management audit logs, CI/CD activity, and runtime events to identify suspicious activity and trace it to the originating VM and repository.
- Deploy the Wiz Sensor to self-hosted VCS instances or CI runner workloads to detect suspicious activity, including outbound requests to known cryptocurrency-mining domains.
- Analyze version control and CI/CD audit logs for suspicious repository cloning, deletion of branch-protection rules, and provisioning of privileged personal access tokens.
- Inspect container repositories for images containing plaintext credentials or cleartext SAS tokens, and detect unrestricted image overwrites.
- Sign container images during builds and verify signatures before deployment.
- Data Sources
- Source code management audit logs
- CI/CD activity and platform audit logs
- Repository metadata and settings
- Developer identity data from version control systems, identity providers, and cloud accounts
- Runtime events and CI runner activity
- Container registry and image data
- Rule Types
- Repository configuration and access-control security rules
- Branch protection and code-review policy checks
- CI/CD workflow security checks
- Container registry and artifact security checks
- Container image signature verification
- Platforms
- Wiz
- Defensive Actions
- Require peer review before merging into protected branches and block force pushes to default branches.
- Restrict self-hosted GitHub Actions and GitLab Runners to authorized repositories, and prevent workflows from auto-approving pull requests.
- Remove or review inactive users with administrative privileges, external collaborators with repository write access, and overprivileged service accounts or GitHub Apps.
- Investigate suspicious repository access, branch-protection changes, and newly provisioned administrative personal access tokens.
- Restrict container image overwrites and remediate plaintext credentials or cleartext SAS tokens in images.
- Sign images during builds and verify their signatures before deployment to Kubernetes clusters.
- Use compliance reporting to assess policy adherence across product teams, business units, and development environments.
Products
Kong Ingress Controllerand published a malicious Docker image containing a cryptominer—affecting version 3.4.0 of the Kong Ingress Controller. This incident underscores the reality that supply chain security doesn’t stop atWiz Admission Controllerduring the build process (via the WizCLI) and verifying signatures before deployment using the Wiz Admission Controller.Wiz Codeof modern Application Security Posture Management (ASPM). Instead of merely shifting security left, Wiz Code integrates security posture management, threat detection, and risk prioritization across the entireWiz Security GraphReviewing developer accounts in the identities inventoryThe Wiz Security Graph consolidates this identity data into a single, queryable model, making it easy to spot risky access patterns such as:Wiz Sensoractivity on a self-hosted CI runnerFor self-hosted VCS instances or workloads running CI runners, the Wiz Sensor can be deployed to detect suspicious activity. For instance, it can flag a CI runner making outboundWizCLIinto the software delivery pipeline by enabling container image signing during the build process (via the WizCLI) and verifying signatures before deployment using the Wiz Admission Controller.