The OWASP Top 10 CI/CD Security Risks names the ways attackers abuse the systems that build and ship software, from flow control to logging. OWASP gives the list no edition year; version 1.0 was published in 2022 and no new version has followed, so the address uses 2022. Each page says what the risk means for a team and where this site has no guide yet.
| Risk | Summary | Guides here |
|---|---|---|
| CICD-SEC-1 Insufficient Flow Control Mechanisms | One identity, a person or a pipeline account, can push code or artifacts all the way to production because nothing in the pipeline requires another review or approval. | 4 |
| CICD-SEC-2 Inadequate Identity and Access Management | Human and machine identities across source control, CI, registries and deployment tools are too many, too powerful, stale, shared, local to one system or tied to personal email addresses. | 1 |
| CICD-SEC-3 Dependency Chain Abuse | Workstations and build environments fetch a malicious package because of how they resolve dependencies: dependency confusion, typosquatting, a hijacked maintainer account or a malicious install script. | 5 |
| CICD-SEC-4 Poisoned Pipeline Execution (PPE) | Someone who can change source control, but not the build system, gets their commands run by the pipeline: by editing the CI configuration, a script or test it calls, or text the workflow interpolates into a shell. | 4 |
| CICD-SEC-5 Insufficient PBAC (Pipeline-Based Access Controls) | Malicious code running in one pipeline uses that pipeline's access, to secrets, the runner host, the network or the CI controller, to move further inside or outside the CI/CD system. | 3 |
| CICD-SEC-6 Insufficient Credential Hygiene | Secrets and tokens spread through the pipeline are over-privileged, long-lived, shared across contexts, committed to code, printed in logs or left inside artifacts. | 6 |
| CICD-SEC-7 Insecure System Configuration | Source control, CI servers, runners and artifact repositories run outdated versions or weak settings: open network access, excess permissions on build nodes, or debug access that exposes secrets in memory. | 1 |
| CICD-SEC-8 Ungoverned Usage of 3rd Party Services | Third-party services, apps, plugins, marketplace actions and OAuth integrations are granted access to source control and CI with little review, so the organization's attack surface includes every one of them. | 3 |
| CICD-SEC-9 Improper Artifact Integrity Validation | Code or artifacts that were changed somewhere in the delivery chain are accepted downstream because nothing checks that they are the ones the trusted process produced. | 6 |
| CICD-SEC-10 Insufficient Logging and Visibility | Logs from source control, CI, registries and deployment systems are not enabled, collected or correlated, so an attacker can act in the pipeline without being detected or reconstructed afterwards. | 1 |
Entries from OWASP Top 10 CI/CD Security Risks (project page). “Guides here” counts the guides whose main subject is the entry or that cover it in a dedicated section.