Beyond SHA Pinning: Security for CI/CD Pipelines#

Andoni Alonso (Prowler) and Paco Sanchez

• Why: Pipeline supply-chain security is adjacent to your network-security remit but highly relevant to infrastructure-as-code hygiene: pipelines hold the credentials that touch your network configs, and the tj-actions incident is the recent case study.
• What: Practical strategies for securing CI/CD pipelines against supply-chain attacks — moving past SHA-pinning actions to attack vectors like repository misconfigurations that yield RCE just from someone opening a pull request (from abstract only).
• How: Threat-modeling the pipeline as a privileged component (code, infrastructure, secrets access), with actionable hardening steps against both common and lesser-known vectors.
• Where applicable: General, tool-agnostic security practices; speaker is from Prowler (cloud security vendor), so expect some product-adjacent framing, but the tj-actions-era attack surface discussion is timely regardless of tooling.