Runbook: Build Pipeline Compromise

Stub runbook. Customize with your CI/CD platform and procedures.

Quick Reference

Identification

Symptoms

• Unexpected code in deployed artifacts
• CI/CD configuration changed without approval
• Secrets accessed or exfiltrated
• Unauthorized workflow runs

Confirm Compromise

• Review CI/CD audit logs
• Compare build artifacts to source
• Check for config changes in CI/CD platform

Immediate Actions

1. Disable compromised pipelines
2. Rotate all secrets and tokens
3. Take down potentially compromised deployments
4. Audit recent builds and deployments

Mitigation

1. Audit CI/CD configuration for unauthorized changes
2. Rebuild from trusted commit using clean pipeline
3. Implement additional approval requirements
4. Review and restrict pipeline permissions

Prevention

• Require approval for CI/CD config changes
• Use short-lived credentials
• Implement branch protection
• Audit pipeline access regularly
• Use signed commits
• Separate build and deploy permissions

Related

• Frontend-Compromise
• Dependency-Attack
• Incident-Response-Policy