Web Security · Senior · Question 57 of 75

Which CI practice best limits the damage of a compromised dependency during builds?

1Running all jobs as root to avoid permission errors
✓Correct answer: Short-lived, narrowly scoped credentials (for example OIDC to the cloud) and no secrets in jobs that run untrusted code
3One long-lived admin token shared by all pipelines

Explanation

Builds that install packages from the internet should assume some code is hostile. Separate publish and deploy steps with their own permissions.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.