What it means
Pipelines are high-value trust systems because they can convert one compromised identity or dependency into signed, widely distributed code.
Why it matters
Securing the delivery path reduces tampering, unauthorized release, secret exposure, and loss of confidence in the provenance of deployed software.
Practical focus
- Use least privilege and short-lived identities
- Isolate and harden build workers
- Verify dependencies and signed artifacts
- Protect production approvals and deployment environments
Common mistakes
- Using persistent shared pipeline credentials
- Allowing untrusted code to access secrets
- Treating build logs as harmless
- Signing artifacts on compromised infrastructure
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: