thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Poisoned Pipeline Execution (PPE)

A CI/CD risk in which an attacker who can modify pipeline configuration or build scripts gets malicious commands executed by the build system.

Definition

Listed in the OWASP Top 10 CI/CD Security Risks (CICD-SEC-4), PPE can occur directly (editing the pipeline file) or indirectly (modifying scripts the pipeline runs), often from untrusted pull requests. Mitigations include running untrusted PR builds without secrets, requiring review for pipeline changes and isolating runners.

Example

A pull request from a fork modifies a test script that the CI runs with access to deployment secrets.

Exam tip

Never expose secrets to builds triggered by untrusted code.

Related terms