Topic starter
09/12/2025 12:09 pm
TL;DR: CI/CD pipelines still concentrate long-lived secrets that can unlock production infrastructure, and Aembit says build runners, not developer workstations, are now a primary theft vector as federation replaces stored credentials with short-lived tokens and cryptographic attestation. The governance challenge is no longer whether federation works, but whether teams can manage trust, scope, and audit across multi-cloud delivery paths.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “Securing CI/CD Pipelines with Workload Identity Federation”.
Key questions
Q: What breaks when CI/CD pipelines rely on static secrets?
A: Static secrets create a reusable attack path into production infrastructure.
Q: Why does a CI/CD breach create so much downstream risk for authentication credentials?
A: CI/CD systems often sit close to source code, deployment workflows, and production access, so a breach can expose credentials that unlock many connected environments at once.
Q: How do you know if workload identity federation is actually reducing risk?
A: You should see fewer long-lived credentials stored in containers, secrets managers, and pipeline variables, plus a smaller set of systems able to mint or reuse Anthropic access.
Practitioner guidance
- Inventory every pipeline-held secret Map credentials stored in code, config files, runner images, logs, and CI/CD variables before deciding what can be replaced with federation.
- Replace static deployment keys with federated tokens Use short-lived workload assertions for deployments, registry pushes, and service calls so the pipeline never stores reusable cloud credentials.
- Tighten trust policies around workflow claims Bind repository, branch, environment, and actor claims to specific roles and deny broad reuse across unrelated workflows or environments.
Bottom line: CI/CD pipelines have become high-value identity targets because static secrets remain reusable long after the build job that created them ends.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 9:26 pm
Static pipeline secrets are now credential debt, not just a configuration flaw. CI/CD environments accumulate access that outlives the job, the runner, and often the team that created it. Once a secret is embedded across configs, logs, and images, the organisation inherits a persistent identity liability that behaves like standing privilege. Practitioners should treat every stored pipeline secret as an exposure window that keeps reopening.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when CI/CD identity spans multiple clouds and services?
A: They should treat federation as a governance model, not a one-off integration. Each additional cloud or service adds another trust relationship, another audit trail, and another place where context can drift. Central policy, consistent claim mapping, and unified logging become necessary once the pipeline must authenticate beyond a single provider.
👉 Read our full editorial: Workload identity federation for CI/CD pipelines is becoming necessary