1 / 3
Identify the running artifact
Identify the environment and artifact from deployment records, separately from source dependency declarations.
Evidence to retain
Environment, version, artifact identity, and the deployment record inspected.
Check what was actually deployed
Connect the running version with the external code executed on its way to deployment.
When to use this guide
Use this when source updates, running versions, and pipeline access are tracked separately.
Build an account of which artifact passed through which privileged steps and where it was deployed.
Where to start
2 / 3
Trace external code
Read external action or script origins and pinned revisions, then map per-step permissions and destinations.
Evidence to retain
A mapping from external code to permissions available in its step.
3 / 3
Record version coverage
Compare observed versions with vendor advisories; keep assets without an observed running version unverified.
Evidence to retain
Compared assets, unverified assets, and reasons.
Apply the rules to your environment
Reconcile advisories with deployed versions →
A web service has updated source dependencies, but its deployed version is uncertain.
Compare the latest deployment record with the identity of the artifact actually deployed.
Inspect external CI code and permissions →
A pipeline executes external actions or scripts and can deploy to production.
Map the execution definitions to the permissions supplied to each step.
Read the source incidents
Equifax: unpatched Apache Struts →
A known Apache Struts vulnerability in the online dispute portal enabled theft of personal information. Patch instructions needed verification of actual deployment.
Codecov: leaked image credential and CI script tampering →
A credential in a public Docker image layer enabled tampering with the Bash Uploader. The modified script exported CI environment information from affected users.
Selected examples. Each record retains its evidence status, unknowns, and sources.
Connect terms to review questions
- Asset
- A service, store, or administrative identity included in the review. Record its owner and purpose as well as its name.
- Which environment and owner does this asset belong to?
- Open the related inspection rule →
- Secret
- A value granting access, such as an API key or authentication token. Review records should identify it without containing the value.
- Can you identify its purpose, target, and owner without opening its value?
- Open the related inspection rule →
- Tool permission
- The destinations, resources, and operations a tool is authorized to use. Text encountered by an AI or pipeline must not grant extra authority.
- Does the execution component check that the target and operation are authorized?
- Open the related inspection rule →
Keep conclusions within the evidence
- Do not treat source or lockfile changes as proof of a patched deployment.
- Do not execute external scripts or expand pipeline permissions for this review.
Separate having an updated version from knowing that it is running in the reviewed environment.
References and review dates
- OWASP: CI/CD Security Cheat Sheet ↗
Pipeline and Execution Environment; Least Privilege; Managing Third-Party Code
- OWASP: Secrets Management Cheat Sheet ↗
2.7 Secret Lifecycle; 2.7.3 Revocation
Learning review 2026-11-12 · Catalog review 2026-11-09
Give this scope to your AI
Share these two rules and examples without expanding the scope. Checks without evidence remain unverified.
Open this inspection pack →Explore another scenario
Follow login and the session after it
Review MFA coverage separately from the mechanisms that stop an authenticated session.
Review secret handling without opening values
Map exposure paths and the process for invalidating old credentials after replacement.
Review exposure and data that remains
Review storage exposure together with the handling of retired environments and data copies.
Keep user and organization data separated
Connect resource authorization with the boundaries controlling reuse of generated responses.
Trace input into queries and file processing
Follow inputs from entry points to SQL construction and file storage or processing.
Separate the blast radius from recovery
Connect reachable resources with containment and restoration records.
Set AI boundaries before delegating a task
Review destinations, action authorization, and traceable records at the execution boundary.