Build YAML Misconfiguration

Detect and prevent security misconfigurations in GitLab CI and Tekton pipeline definitions. Misconfigured build YAML is a common source of secret leakage, privilege escalation, and supply chain compromise.

GitLab CI (.gitlab-ci.yml)

Secret Exposure

• Never hardcode secrets in .gitlab-ci.yml, variables:, or script: blocks. Use CI/CD protected variables or an external vault.
• Mask and protect variables: set masked: true and protected: true on sensitive CI/CD variables. Masked variables are redacted from job logs.
• Never echo secrets: avoid echo $SECRET, printenv, env, or set -x in scripts that handle credentials. Debug output is stored in job logs.
• Restrict variable scope: use protected: true to limit variables to protected branches/tags only. Use environment scoping to restrict which jobs see which secrets.
• Artifacts and caches: never include files containing secrets (.env, credentials, tokens) in artifacts: or cache: paths. These are stored and downloadable.

# BAD -- secret visible in logs and available on all branches
variables:
  DB_PASSWORD: "hunter2"