Pipeline & Runtime

The last four gaps: a CI trigger that hands secrets to strangers, injection bugs a scanner could have caught, a URL feature that reaches cloud credentials, and noticing an intruder inside a running container.

Chapters 0–2 secured what you build and ship. This chapter secures the pipeline that builds it, adds static analysis for the bugs that code review misses, closes the most common cloud-specific application flaw, and ends with runtime detection, for the day something gets through anyway.

1. LAB 3.1CRITICALCICD-SEC-4 · Poisoned pipeline execution

   A CI trigger that trusts strangers

   To label PRs from forks, a workflow uses pull_request_target and checks out the PR's code. That runs untrusted code with repository secrets and a write token.

2. LAB 3.2CRITICALCWE-89 · SQL injection · OWASP A03 Injection

   The injection bug review missed

   A new product-search endpoint builds its SQL query by concatenating the search term. Two reviewers approved it on a busy Friday.

3. LAB 3.3CRITICALCWE-918 · Server-side request forgery · OWASP A10

   A URL field that can reach cloud credentials

   A new 'import product image from URL' feature fetches whatever URL it's given — from inside the VPC, next to the instance metadata service.

4. LAB 3.4HIGHMITRE ATT&CK T1059 · Command and scripting interpreter (containers)

   Someone opened a shell in production

   Every preventive layer can fail. When someone does get inside a running container, how long until you know?