pipeline-security
Installation
SKILL.md
Pipeline Security
CI/CD pipelines are one of the highest-leverage attack targets in most organizations, and defended far less than production itself: a compromised pipeline can push malicious artifacts straight to production, exfiltrate every secret it touches, and do it with legitimate-looking commits and green checkmarks. Treat the pipeline with the same rigor as production infrastructure — because functionally, it has more power than production, it's what creates production.
If your pipeline can deploy to production, your pipeline security posture is your production security posture.
A pipeline that can push to production must be defended as rigorously as production itself — it is a privileged system, not a convenience layer.