Client
SaaS platform
Service
Cloud & CI/CD review
Location
Undisclosed
A pull request from a fork could run the pipeline. The pipeline held a token that could write to production.
The Challenge
Fork-based contribution and privileged CI are each reasonable on their own. Together they are a supply-chain problem: the workflow trigger ran on pull requests from forks, and the job it started had the deployment credential in its environment.
An attacker does not need write access to the repository for this. They need a pull request, and the pipeline hands them the rest.
The Approach
We reviewed the workflow definitions before touching anything, looking at which triggers run untrusted code and which of those jobs receive secrets.
One combination lined up. We demonstrated it in a controlled fork against a non-production target, captured the credential exposure and reported it the same hour. Pushing to production was never necessary to prove the path.
The Outcome
The trigger was changed so untrusted code no longer runs with access to deployment secrets, and the token was rotated and scoped down.
We retested after the workflow change. Reported as HIGH in 2025. Retest included in the engagement.
Case Studies
