Insufficient Logging and Visibility

Incidents (3)

Attack path techniques used

• Push directly, without review (Submit malicious code)
• Add a workflow that dumps secrets (Steal CI secrets and tokens)
• Publish a malicious version with a stolen token (Poison the build or published package)
• Leave a dormant workflow behind (Keep access)

Checklist items

The fixes for those techniques, plus the items ghtier tags with this risk.

• Branch protection on default/release branches: required reviews + required status checks
• Rulesets applied: push restriction, tag protection, sensitive file-path protection
• CODEOWNERS in place, required on sensitive paths
• Inventory every Actions secret and its visibility/scope; the results are usually surprising
• Cloud credentials migrated from static keys to OIDC federation, scoped to repo + branch
• Adopt artifact attestations for build provenance on published binaries/images
• Publish packages with trusted publishing (OIDC) instead of long-lived registry tokens
• Put production secrets in environments with required reviewers
• Write and rehearse a credential-rotation runbook before you need it
• Enable audit logging and export it to a SIEM for retention and detection
• Add a .github/SECURITY.md with a disclosure contact and process

Permissions involved

The GitHub permissions those incidents abused.