DevOps Articles

Let’s Hack a Pipeline: Argument Injection

In this series of posts, we’ll walk through some common security pitfalls when setting up Azure Pipelines. We don’t really want to get hacked, so we’ll also show off the mitigation.

The purpose of this series is to teach the problems, which we hope helps you avoid them in practice.

A better approach to securing a pipeline would be focusing on what resources the pipeline can access, who can run the pipeline and in what queue/pool. We can set access contorol on all sorts of things in the devops space including pools and secrets.