Ensure scanners are in place to identify and prevent sensitive data in pipeline files

secrets_scan

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Family

CI/ CD tools

Description

Detect and prevent sensitive data, such as confidential ID numbers, passwords, etc., in pipelines. You can configure tools or run commands to check for workflows using tools to verify this. The parameters are tools and commands.

Security

Sensitive data in pipeline configuration, such as cloud provider credentials or repository credentials, create vulnerabilities with which malicious actors could steal such information if they gain access to a pipeline. In order to mitigate this, set scanners that will identify and prevent the existence of sensitive data in the pipeline.

For every pipeline that is in use, verify that scanners are set to identify and prevent the existence of sensitive data within it.

Mitigation / Fix

Add a secrets scan to every pipeline, so a credential committed by mistake is caught before it reaches a shared branch. The check looks for a known secrets scanner in the pipeline definitions and build scripts of the project.

This check reads pipeline definitions and build scripts only. A scan run anywhere else — from a developer’s machine, or a pipeline living in another repository — is not visible to it, so the finding stays open until the scanning step belongs to a pipeline this project owns.

Xygeni Secrets Security

Xygeni Secrets Security scans the working tree and the git history, and validates a candidate against its provider so a rotated or fake credential is not reported as live. Add the scanner command to the workflow:

# Secrets only
xygeni secrets -n $PROJECT -d .

# Or together with the other scans of the same run
xygeni scan --run=secrets,sast,deps -n $PROJECT -d .

On GitHub Actions the same scan is available as an action, and on Azure Pipelines as the xygeni-scanner task with secrets: true:

- name: Xygeni Secrets
  uses: xygeni/xygeni-action@<commit-sha> # pin to a release commit
  with:
    command: secrets
    token: ${{ secrets.XYGENI_TOKEN }}

Scanning the pipeline is the last line, not the first: a secret already pushed must be rotated, not only removed. Use --only-verified when you want the pipeline to fail on confirmed-live credentials alone.