Open cardosec

Case 6ECB58 · Cloud · L4 Advanced

CI Secret Opened Production

Practise as: Incident drill · InterviewLevel: L4 Advanced

Live alertA pull request to a public repository triggered a workflow using pull_request_target that checked out and ran the PR code. That code read a long-lived AWS admin access key stored as a repository secret and used it to create IAM users in the production account.

Interview questionAn attacker used a pull request to steal a CI secret and get into production. What architectural changes stop this from happening again?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Contain first: delete the key and the created users, review CloudTrail for everything the key did, and check for other persistence.
  2. pull_request_target runs with repository secrets; never check out and run untrusted PR code in that context.
  3. Replace stored keys with OIDC federation and a deploy role whose trust policy names the repository, branch and environment.
  4. Limit blast radius: separate accounts per environment, least-privilege deploy roles, and org-level guardrails (SCPs) on IAM changes.

If the interviewer pushes back

  • How would you find every other workflow in your organization with the same pattern?

Go deeper

More Cloud cards

All Cloud cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09