CI/CD Secrets & Access Hardening for DevSecOps Pipelines

Overview

This project demonstrates how insecure CI/CD pipelines expose secrets, over-privilege access, and violate least-privilege principles and how to harden pipelines using secure secrets handling, scoped access, and security validation.

The focus is pipeline security design, not application complexity.

Objective

Demonstrate:

- Common CI/CD security anti-patterns

- Secrets exposure risks

- Over-privileged pipeline access

- Hardened pipelines using least-privilege and validation controls

Scope

- Show bad vs good pipeline design

- Demonstrate secrets exposure risks

- Enforce least privilege

- Add security validation gates

Repository Structure

- insecure-pipeline/ : intentionally vulnerable pipeline

- secure-pipeline/ : hardened pipeline

- policies/ : security validation rules

- docs/ : threat model and security decisions