Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

Poisoned pipeline execution

Running attacker code in a CI/CD pipeline by modifying its configuration or the code it builds, to steal secrets or tamper with artefacts (ATT&CK T1677).

Poisoned pipeline execution (PPE) is the abuse of a CI/CD pipeline to run attacker-controlled commands with the pipeline's privileges. In the direct form, the attacker edits the pipeline definition itself, such as a .github/workflows/*.yml pushed to a new branch. In the indirect form, they modify files the pipeline executes (build scripts, tests, a dependency or a third-party action).

MITRE ATT&CK tracks it as T1677, and OWASP lists it among the Top 10 CI/CD security risks. The usual goal is secrets. See GitHub Actions secrets leak.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.