ghtier
← Threat landscape

OWASP Top 10 CI/CD Security Risks

Version 2022. Each row lists the incidents on ghtier that ghtier maps to it. The mapping is ghtier's own reading, not the framework author's. Read the framework

ItemIncidentsLast 12 monthsMost recent
CICD-SEC-1 Insufficient Flow Control Mechanisms64ChainDrop: a hijacked maintainer account publishes through trusted publishing
CICD-SEC-2 Inadequate Identity and Access Management71ChainDrop: a hijacked maintainer account publishes through trusted publishing
CICD-SEC-3 Dependency Chain Abuse52ChainDrop: a hijacked maintainer account publishes through trusted publishing
CICD-SEC-4 Poisoned Pipeline Execution (PPE)84Megalodon: mass backdooring of CI workflows
CICD-SEC-5 Insufficient PBAC (Pipeline-Based Access Controls)62prt-scan: automated pull_request_target attacks
CICD-SEC-6 Insufficient Credential Hygiene154ChainDrop: a hijacked maintainer account publishes through trusted publishing
CICD-SEC-7 Insecure System Configuration71CVE-2026-3854: push-option metadata RCE
CICD-SEC-8 Ungoverned Usage of 3rd Party Services60GitHub MCP / agentic token breadth
CICD-SEC-9 Improper Artifact Integrity Validation83ChainDrop: a hijacked maintainer account publishes through trusted publishing
CICD-SEC-10 Insufficient Logging and Visibility31Megalodon: mass backdooring of CI workflows

Other frameworks

NIST SP 800-204DSLSA, OpenSSF Scorecard, the CIS benchmark, NIS2 and DORA are planned.