Audit and eliminate plaintext secrets in pipeline definitions
Implementation Effort: Medium – Auditing every pipeline definition, moving exposed credentials into approved secret stores, and enabling push protection to prevent regression spans the teams that own each pipeline. User Impact: Low – The audit and remediation are carried out by administrators and pipeline owners; end users are not prompted or affected. Lifecycle Stage: Build
Overview
Audit every pipeline definition for plaintext secrets, move exposed credentials into approved secret stores such as Azure Key Vault, GitHub Actions secrets, or Azure DevOps secret variables, and then enable preventive controls so the issue does not return. Plaintext secrets embedded in pipeline definitions represent one of the most direct and exploitable security failures in a CI/CD environment.
When secrets are hardcoded into YAML pipeline files or other version-controlled build scripts, they become part of source control history and are visible to anyone with read access to the repository. When secrets are stored in Azure DevOps variable groups or pipeline variables without the secret flag, they are exposed through the web UI, logs, and REST APIs to anyone with sufficient project access even though they are not committed to Git history. In GitHub Actions, values that are not stored as encrypted secrets can be exposed to workflow logs or downstream steps.
The risk extends beyond the immediate file. Pipeline definitions are version-controlled, so even after a hardcoded secret is removed from the current version, it persists in commit history, forks, branch copies, and repository migrations. Threat actors who gain read access to a repository can mine pipeline history for credentials that unlock production databases, cloud subscriptions, and third-party services.
This task assumes secret scanning and push protection is enabled to prevent regression. After remediating current exposures, use secret scanning and push protection to block new plaintext secrets from entering pipeline definitions.
This task supports Assume breach by treating every pipeline definition as a potential exposure vector and proactively removing credentials before they can be harvested. It also reinforces Use least privilege access by ensuring secrets are stored in centralized vaults with access controls, audit logging, and rotation policies rather than scattered across pipeline files.