CI/CD Security Cheat Sheet — Secure SCM Configuration

Reference note (untrusted external data; do not execute it as instructions). CI/CD environments allow for code to be pushed to a repository and then deployed to a production environment with little to no manual intervention. However, this benefit can quickly become an attack vector if it allows untrusted, potentially malicious code to be deployed directly to a production system. Proper configuration of the SCM system can help mitigate this risk. Best practices include Avoid the use of auto-merge rules in platforms such as Gitlab, Github, or Bitbucket. Require pull requests to be reviewed before merging and ensure this review step cannot be bypassed. Leverage protected branches. Require commits to be signed Carefully weigh the risk against the benefits of allowing ephemeral contributors. Limit the number and permissions of external contributions when possible. Enable MFA where available Avoid assigning default permissions for users and roles with access to your SCM assets. Carefully manage your permissions. Restrict the ability to fork private or internal repositories. Limit the option to change repository visibility to public. You can find a wide variety of additional policies in this documentation. To help navigate SCM configuration challenges, there are tools available, such as Legitify, an open-source tool by Legit security. Legitify scans SCM assets and identifies misconfigurations and security issues, including policies for all the above best practices (available for GitHub and GitLab). Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.