Audited our CI last week: 4 long-lived cloud keys, one 3 years old, one belonging to someone who left in 2024.
Siddharth Saxena
AppSec Engineer @ Moneyleaf | OWASP, threat modeling, bug bounty | Making security developer-friendly
Audited our CI last week: 4 long-lived cloud keys, one 3 years old, one belonging to someone who left in 2024.
Moved everything to OIDC federation (GitHub Actions → AWS role). No static keys left. Took one afternoon.
4 reactions2 comments