DevOps & CI/CD
Pipelines hold the keys.Know which ones.
CI/CD is where the most powerful credentials in the company meet the least reviewed code. Trustivan inventories GitHub App installations, bot accounts and repositories and HashiCorp Vault AppRoles, matches every reported exposure to its identity, and shows what each identity can reach.
Connectors available today: HashiCorp Vault · GitHub
- Repository
platform/webDeploy key (rw)added 2023 · owner left - Pipeline
deploy-prod.ymlJob token + 38 CI variables3 variables hold cloud keys - Runner
self-hosted · pool-euRunner registration tokenrotated 12d ago - Terraform
workspace prod-coreTeam token (static)provider creds in state - Cloud account
prod-coreStatic access keyOIDC trust available
CI/CD identity types
Every hop in the pipeline is an identity
From the deploy key on the repository to the role the pipeline assumes in production, each hop authenticates with something — and each something has an owner, an age and a blast radius.
Source control identities
GitHub App installations and the members GitHub marks as bots, with repositories as resources
Pipeline & runner identities
Job tokens, CI variables, self-hosted runners and service connections — no connector reads them yet
IaC & registry identities
Terraform team tokens, credentials in state and registry push tokens — no connector reads them yet
Federated identities
OIDC trusts from CI providers to clouds — workflow identities are not discovered yet
CI/CD risks
Where pipelines leak authority
Six failure patterns specific to build and deployment systems, the signal Trustivan surfaces for each and its honest status.
Secrets in repositories and pipelines
Trustivan surfacesExposures reported through the ingestion API, matched to the credential and identity they belong to — no scanner ships
Unowned GitHub Apps
Trustivan surfacesApp installations and bot accounts with no resolvable owner, raised as findings with the installation’s evidence
OIDC trust conditions too broad
Planned signalTrusts that accept any branch, any repository or any environment from the CI provider — workflow identities are not read yet
Over-scoped personal tokens used by automation
Planned signalPATs with organization-wide write attached to bots and pipelines — the GitHub connector does not read personal access tokens yet
Runner credential exposure
Planned signalSelf-hosted runners holding cloud credentials reachable from pull-request builds — runners are not read yet
Provider credentials in state files
Planned signalTerraform state containing cloud keys and connection strings — no Terraform connector ships yet
How it works
Match the secret. Name the identity. Bound the pipeline.
Three moves for CI/CD: match every reported exposure to its identity, flag the static keys a federated path should replace, and know what a deployment identity can reach in production.
A credential in a repository is a finding about an identity, not about a file
Secrets turn up in commits, history, CI variables, build logs and state files. When one is reported through the ingestion API, Trustivan matches it to the credential it belongs to, the identity that holds it and the resources that identity reaches — so the ticket says what the key unlocks, not just where it was found.
- Exposures arrive through the ingestion API from the scanner you already run — Trustivan ships none.
- Use after exposure from activity submitted through the same boundary, per credential.
- Revoke and rotate proposals approved by a second person and recorded; nothing executes at the provider.
Replace the key in the CI variable with a trust the cloud can verify
GitHub Actions, GitLab CI and other providers can prove a job's identity with OIDC. Today Trustivan flags the AWS access keys that stay static — by age, rotation and exposure — and draws the role trust a federated path would land in. Finding keys stored as CI variables and generating trust configuration are future capabilities.
- Static keys ranked by age and by what the identity that holds them can reach.
- Role trust on the graph, so the account a federated job would land in is visible.
- Findings, not migration: Trustivan does not rotate, revoke or delete keys at the provider.
- Rotation overdue
- Rotated
- Reported exposed
- Short-lived
aws-access-key/AKIA…7Q2Fsvc-billing-export›Rotation overdue · 611 daysaws-access-key/AKIA…M4TDetl-runnerRotated every 90 daysruntime-credential/support-copilotsupport-copilotAgent credential · 30-day lifetime
A pipeline that can deploy should not be able to destroy
Deployment identities accumulate permissions with every incident and every hurried fix. Trustivan computes what a deployment identity can reach — as an upper bound — and flags privileged, unowned and high-impact access. Comparing that with what its jobs actually used needs per-grant usage no provider reports, so used versus granted is a future capability.
- Effective access per identity, from trust, group membership and inline policy statements.
- High-impact access flagged when an identity can reach a resource classified high impact.
- Unused stays unknown: no provider reports per-grant use, so nothing is recommended for removal on a guess.
Integration coverage
Code and CI/CD connectors, labelled honestly
Source control, pipelines, infrastructure as code, registries and the vault your pipelines should read from. HashiCorp Vault and GitHub ship today; the rest are planned.
View all integrations- GitHubApp installations, bot members, repositories and their visibilityAvailable
- HashiCorp VaultAppRoles, machine identity entities, auth mounts, policy namesAvailable
- Azure DevOpsService connections, PATs, pipelinesPlanned
- BitbucketApp passwords, access keys, pipeline variablesPlanned
- BuildkiteAgent tokens, cluster queuesPlanned
- CircleCIContexts, environment variables, OIDCPlanned
- Docker HubAccess tokens, organization membersPlanned
- GitLabTokens, deploy keys, CI variables, runnersPlanned
- JenkinsCredentials store, service users, job bindingsPlanned
- JFrog ArtifactoryAccess tokens, service usersPlanned
- Terraform CloudWorkspaces, variable sets, team tokensPlanned