> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Pipeline Identity and Secrets (ID)

- URL: /taxonomies/software-factory/pipeline-identity-and-secrets/
- Published: 2026-10-26T12:48:28.200Z
- Updated: 2026-10-29T12:49:29.826Z
- Description: Pipeline Identity and Secrets (ID): 13 threats, software factory taxonomy. Secret stores, OIDC federation, tokens, service accounts, access to signing keys.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Pipeline Identity and Secrets

**Station 05 of 17 · Line 1, Source to Artifact · 13 threats · prefix ID**

The pipeline is usually the most privileged identity in the organisation, and most attacks on it end in credential theft. These cards cover secret stores, federated identity, job tokens, service accounts and access to signing keys.

**Scope:** Secret stores, OIDC federation, tokens, service accounts, access to signing keys.

![Table: Pipeline Identity and Secrets (ID), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/108/taxonomy-table-05-ID.png =1400x4232)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="id-a"></span>**ID·A** Long-Lived Static Credential
- <span id="id-k"></span>**ID·K** Loose Federation Claims
- <span id="id-q"></span>**ID·Q** Secrets in Untrusted Runs
- <span id="id-j"></span>**ID·J** Over-Scoped Job Token
- <span id="id-10"></span>**ID·10** Signing Key Exposure
- <span id="id-9"></span>**ID·9** Publishing Credential Reach
- <span id="id-8"></span>**ID·8** Credentials Left in the Workspace
- <span id="id-7"></span>**ID·7** Incomplete Rotation
- <span id="id-6"></span>**ID·6** Secret Store Compromise
- <span id="id-5"></span>**ID·5** Cross-Environment Reuse
- <span id="id-4"></span>**ID·4** Secret Sprawl
- <span id="id-3"></span>**ID·3** Machine Identity Sprawl
- <span id="id-2"></span>**ID·2** Debug Access Leak

## Where this station touches others

- **Pipeline Identity and Secrets and every other station:** Pipeline Identity covers the credentials themselves; each other station covers what a credential lets its component do.

## Seen in the wild

- **ID·A Long-Lived Static Credential:** Codecov (2021); CircleCI (2023).
- **ID·K Loose Federation Claims:** OIDC trust policy research (Datadog, Rezonate, 2023).
- **ID·Q Secrets in Untrusted Runs:** tj-actions/changed-files (2025).
- **ID·J Over-Scoped Job Token:** OWASP CICD-SEC-5.
- **ID·10 Signing Key Exposure:** MSI and Intel Boot Guard keys leak (2023).
- **ID·9 Publishing Credential Reach:** Shai-Hulud (2025).
- **ID·8 Credentials Left in the Workspace:** ArtiPACKED (Unit 42, 2024).
- **ID·7 Incomplete Rotation:** Trivy (2026).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 10 cleanly and 3 only loosely. CAPEC 3.9 has a pattern that describes 1 of them directly, only a generic parent pattern for 10, and nothing for 2. CWE 4.20 names the weakness directly for 5, has only a broader weakness for 7, and nothing for 1. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Pipeline Identity and Secrets (ID), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/108/software-factory-mapping-table-05-ID.png =1400x1984)

---

← [Runners (RN)](/taxonomies/software-factory/runners/) · [Software factory overview](/taxonomies/software-factory/) · [Build Systems (BS)](/taxonomies/software-factory/build-systems/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*