# What is CI/CD Pipeline Security?

> Continuous integration and continuous delivery or deployment (CI/CD) pipeline security is the protection of the systems, identities, code, dependencies, instructions, execution environments, and artifacts used to build, test, approve, and release software.

- Canonical URL: https://yellowcube.eu/glossary/continuous-integration-and-continuous-delivery-or-deployment-pipeline-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Its purpose is to prevent unauthorized changes, credential theft, untrusted execution, artifact substitution, and misuse of the pipeline’s often powerful access to source repositories and production environments.

The pipeline should be treated as a production control plane. Security spans repository rules, automation services, runners, plug-ins, secrets, build inputs, artifact stores, signing or attestation services, release approvals, deployment credentials, logging, and recovery — not merely the checks inserted into a build.

### Key points

- **Identity and flow control:** Separate human and workload identities, apply least privilege, protect administrative changes, require suitable review or approval, and restrict which events, branches, and actors can trigger privileged jobs.
- **Execution and dependencies:** Isolate jobs, prefer ephemeral workers, pin or verify external actions and tools, constrain network access, and prevent untrusted contributions from receiving sensitive credentials.
- **Artifact integrity:** Bind outputs to reviewed source and build instructions, record provenance, protect signing material, verify artifacts before promotion, and retain tamper-evident evidence for investigation.
- **Important limitation:** A protected pipeline does not establish that the software it releases is free of security defects. Conversely, adding application scanners does not secure the pipeline identities, runners, control plane, or artifact path that could alter or bypass their results.

### Related terms

[DevSecOps](<https://yellowcube.eu/glossary/devsecops/>) · [Software supply-chain security](<https://yellowcube.eu/glossary/software-supply-chain-security/>) · [Software bill of materials (SBOM)](<https://yellowcube.eu/glossary/software-bill-of-materials/>) · [Secrets management](<https://yellowcube.eu/glossary/secrets-management/>) · [Infrastructure as code (IaC) security](<https://yellowcube.eu/glossary/infrastructure-as-code-security/>) · [Shift-left security](<https://yellowcube.eu/glossary/shift-left-security/>)

### Sources

[NIST SP 800-204D: Software Supply Chain Security in DevSecOps CI/CD Pipelines](https://csrc.nist.gov/pubs/sp/800/204/d/final) · [OWASP CI/CD Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/CI_CD_Security_Cheat_Sheet.html) · [SLSA Specification 1.2](https://slsa.dev/spec/v1.2/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.