They often treat rotation as equivalent to removal. Rotation shortens exposure, but it still leaves a valid secret that can be stolen during its lifetime. If the workflow can operate without a standing secret, secretless publishing is the stronger control because it removes the object attackers want to steal.
Why Security Teams Misread Rotation in CI Pipelines
token rotation is often treated as the finish line, but in CI pipelines it is usually only exposure management. A rotated token is still a live secret until the next change, and attackers only need a brief window to copy it from logs, runner memory, artifacts, or misconfigured variables. The real problem is the standing secret itself, especially in fast-moving delivery systems where trust boundaries are thin. The Guide to the Secret Sprawl Challenge shows why sprawl persists even when teams believe they have “covered” the pipeline, while OWASP’s OWASP Non-Human Identity Top 10 frames secret lifecycle failures as a core identity risk, not just a hygiene issue.
The common mistake is assuming rotation compensates for weak workload design. If a build job can authenticate with a long-lived token, then compromise before, during, or after rotation still yields usable access. In practice, many security teams encounter token theft only after a runner, dependency, or pipeline variable has already been abused, rather than through intentional secretless design.
What Stronger CI Authentication Looks Like
Safer pipelines move away from static tokens toward workload identity and just-in-time credential issuance. Instead of embedding a reusable secret in the CI system, the job proves what it is at runtime and receives a short-lived credential only for that task. That is the operational difference between “rotated” and “removed.” Current guidance suggests treating the pipeline as an autonomous workload that should request access contextually, not inherit standing privilege by default.
In practice, that means combining identity federation, short TTLs, and policy checks at request time. Common implementations use OIDC-based workload identity, SPIFFE-style workload identities, or cloud-native federation so the runner can exchange an attested identity for a scoped token. The decision should be enforced by policy-as-code and evaluated at runtime, not baked into a static allowlist. The Guide to NHI Rotation Challenges and the NHI Lifecycle Management Guide both reflect the same operational reality: lifecycle control matters most when issuance, use, and revocation are tightly coupled.
- Issue credentials per job, not per repository or team.
- Bind access to workload identity and build context, such as branch, environment, and deployment target.
- Set short expiry times and automatic revocation on job completion or failure.
- Prevent secrets from reaching logs, caches, artifacts, and shell history.
- Prefer secretless publishing where the toolchain can use federated identity directly.
GitGuardian’s State of Secrets Sprawl 2026 reports that 64% of valid secrets leaked in 2022 were still valid and exploitable later, which is exactly why rotation alone is not enough. These controls tend to break down in shared runners and self-hosted build fleets because reuse, caching, and side effects make token exposure much harder to contain.
Where Rotation Still Helps, and Where It Fails
Tighter token controls often increase delivery friction, requiring organisations to balance pipeline reliability against exposure reduction. That tradeoff is real, especially in legacy CI environments where external registries, signing services, and release automation still expect a reusable credential. Current guidance suggests using rotation as a transitional control, not a final state, when secretless publishing is not yet possible.
Rotation still has value when a secret cannot yet be eliminated, but it fails as a primary defence if the token is duplicated across jobs, copied into tickets, or shared across multiple applications. Entro Security reports that 60% of NHIs are overused and that 44% of NHI tokens are exposed in the wild, which is the opposite of the single-purpose, short-lived model security teams want. This is where the broader NHI issue becomes visible: the more places a token can exist, the less meaningful rotation becomes. The same dynamic is echoed in the Top 10 NHI Issues and the CI/CD pipeline exploitation case study.
Best practice is evolving toward eliminating standing secrets from build and release paths altogether. Where that is not yet achievable, teams should treat rotation as a compensating control, backed by inventory, detection, and automated revocation. The control breaks down most clearly in high-churn CI systems with parallel jobs, distributed runners, or build steps that must hand credentials to third-party tools that cannot speak federation natively.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Rotating CI tokens is a lifecycle control, but standing secrets still create exposure windows. |
| OWASP Agentic AI Top 10 | CI pipelines behave like autonomous workloads that should not rely on reusable secrets. | |
| CSA MAESTRO | MAESTRO emphasizes identity, policy, and runtime control for automated workload access. | |
| NIST AI RMF | GOVERN | Token rotation decisions need accountability and risk governance, not just technical renewal. |
| NIST Zero Trust (SP 800-207) | AC-3 | Zero Trust requires continuous, context-based authorization rather than trust in standing tokens. |
Shorten token lifetime, inventory every NHI secret, and remove standing credentials from pipeline workflows.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
