# CI/CD Attack Surface

> Master CI/CD pipeline threat modeling, runner security, and the prevention of secret leakage and workflow injection attacks.

Canonical: https://codelivly.com/rooms/cicd-attack-surface
Last updated: 2026-10-29

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 100 |

This module dives deep into the vulnerabilities inherent in modern software delivery pipelines. You will learn how to threat-model CI/CD architectures, identify critical attack vectors such as compromised runners, poisoned pipeline execution, and workflow injection. We will cover strategies for securing self-hosted and ephemeral runners, protecting pipeline variables from exfiltration, and enforcing strict least-privilege access for pipeline identities. The module culminates in a hands-on guided lab where you will audit a vulnerable CI/CD workflow, identify injection flaws, and implement robust hardening controls to secure the delivery pipeline.

## Lessons

1. What Is the CI/CD Attack Surface and Why Does It Matter (30 min)
2. Poisoned Pipeline Execution and Script Injection (30 min)
3. Malicious Pull Requests from Forks (30 min)
4. Compromised Third-Party Actions and Plugins (30 min)
5. Guided Lab: Exploiting and Fixing a Vulnerable GitHub Actions Workflow (30 min)

## Related

- [Learning path: Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)
- [All rooms](https://codelivly.com/rooms)