Secrets Scan in CI
Run a focused security review: scan for leaked secrets, verify least-privilege IAM, and confirm dependency provenance before release.
Objective
Block the release if a leaked secret, an over-privileged role, or a critical dependency vulnerability is found.
Environment
- A working security environment with access to the target system and its tooling
- Configuration and credentials for the security workflow installed and verified
- A rollback or undo path documented before any change is applied
Steps
1. Scan for leaked secrets
Run a secret scanner across the repository and built artifacts and fail on any high-confidence finding.
Expected state: No leaked secrets are present in the repo or artifacts.
2. Review IAM for least privilege
Compare each role and policy against the actions the service actually uses and remove unused permissions.
Expected state: Every role grants only the actions required and excess permissions are removed.
3. Verify dependency provenance
Generate an SBOM, check each dependency against the vulnerability database, and confirm signatures where available.
Expected state: SBOM is produced and no critical or high vulnerability is unresolved.
Decision points
Should the build fail on a high-severity finding?
- Yes, fail the build and block release
- No, warn and allow override
Fail the build on high or critical findings; allow override only with a recorded risk acceptance from the owner.
Expected outcome
Block the release if a leaked secret, an over-privileged role, or a critical dependency vulnerability is found. The change is verified and a rollback path is confirmed.
Verification
Block the release if a leaked secret, an over-privileged role, or a critical dependency vulnerability is found. Compare before and after metrics and confirm the expected state is reached.
Cleanup
Archive the run artifacts, remove temporary credentials, and update the runbook with any changes.
Overview
Run a focused security review: scan for leaked secrets, verify least-privilege IAM, and confirm dependency provenance before release. The goal is to block the release if a leaked secret, an over-privileged role, or a critical dependency vulnerability is found.
trivy fs --severity HIGH,CRITICAL --exit-code 1 .Steps
-
Scan for leaked secrets. Run a secret scanner across the repository and built artifacts and fail on any high-confidence finding. Expected: No leaked secrets are present in the repo or artifacts.
-
Review IAM for least privilege. Compare each role and policy against the actions the service actually uses and remove unused permissions. Expected: Every role grants only the actions required and excess permissions are removed.
-
Verify dependency provenance. Generate an SBOM, check each dependency against the vulnerability database, and confirm signatures where available. Expected: SBOM is produced and no critical or high vulnerability is unresolved.
Verification
Confirm the outcome by checking: block the release if a leaked secret, an over-privileged role, or a critical dependency vulnerability is found. Run the verification command and compare the result against the expected state. If any check fails, stop and investigate before continuing.
Decision points
- Should the build fail on a high-severity finding?
- Yes, fail the build and block release
- No, warn and allow override
- Recommendation: Fail the build on high or critical findings; allow override only with a recorded risk acceptance from the owner.