4 ms·

edit: Credentials for modifying the piepline were found in the .git/config file

• zettabomb 2y ago
  With Bitbucket, as well as Gitlab and likely others that I haven't used, the CI pipelines are stored as a plaintext configuration in the repo itself. So, repo commit access automatically gives you the ability to modify the pipeline.
  • lost_womble 2y ago
    This is why things like codeowners files are so important
• matharmin 2y ago
  It's right at the start of the post - the git remote including credentials was exposed via the .git directory