Skip to content
BreachPathAttack Path LibraryStart
AdvancedIntellectual-property theftData theft

Source-control token to production environment

A leaked source-control token grants access to private repositories, where hardcoded secrets and CI/CD trust are used to reach and exfiltrate from the production environment and its source code.

Technologies
Custom web applications, AWS, Azure
Entry points
Stolen credentials, Supplier compromise
Sectors
SaaS & technology, Financial services, Manufacturing
Stages
4
01

A leaked source-control token is used

A personal access token or CI credential is exposed — in a public artifact, a misconfigured system, or a compromised developer machine — and the attacker uses it to authenticate to the organisation's private repositories.

Attacker objective

Authenticate to the source-control platform using an exposed token or credential.

MITRE ATT&CK
Controls that should stop this
  • Short-lived, scoped tokens with mandatory expiry and rotation
  • Secret scanning on commits and public exposure monitoring
  • MFA and SSO enforcement on the source-control platform
What defenders should see
  • Token use from unfamiliar locations or automation
  • Access to repositories the token owner does not normally touch
  • Secret-scanning alerts for exposed credentials
What a pentest validates
  • Scan for exposed tokens across public and internal surfaces
  • Review token scope, lifetime and rotation practice
  • Test SSO/MFA enforcement on the platform
Business impact

The attacker can now read private source and its history.

02

Secrets and CI/CD configuration are harvested

The attacker searches repositories and their history for embedded secrets, and reviews CI/CD pipeline configuration to understand what credentials the automation holds and what it can deploy to.

Attacker objective

Find hardcoded secrets and understand how code reaches production.

MITRE ATT&CK
Controls that should stop this
  • Central secrets management; no secrets in code or history
  • Least-privilege pipeline credentials scoped per environment
  • Branch protection and review requirements on pipeline changes
What defenders should see
  • Bulk cloning or history access across many repositories
  • Access to CI/CD configuration and secret stores
  • Pipeline credential use outside normal deployment windows
What a pentest validates
  • Review repositories and history for embedded secrets
  • Map what pipeline credentials can access and deploy
  • Validate branch protection on pipeline definitions
Business impact

The attacker learns the credentials and trust that connect code to production.

03

Production is reached through pipeline trust

With secrets or the ability to influence the pipeline, the attacker authenticates to production services or causes the trusted automation to act on their behalf, reaching live systems and data.

Attacker objective

Use harvested secrets or pipeline trust to access the production environment.

MITRE ATT&CK
Controls that should stop this
  • Environment separation so build credentials cannot reach production data
  • Signed builds and provenance checks in the deployment path
  • Approval gates and anomaly detection on deployments
What defenders should see
  • Deployments or production access outside change windows
  • Pipeline-initiated actions that deviate from known-good patterns
  • Production credential use from unexpected sources
What a pentest validates
  • Test whether pipeline access reaches production data
  • Validate build provenance and deployment approval gates
  • Review environment separation between CI/CD and production
Business impact

The attacker gains a foothold in live production via trusted automation.

04

Source code and production data are exfiltrated

The attacker collects source code and reachable production data and moves it out, potentially retaining pipeline access for future use.

Attacker objective

Remove the intellectual property and data that are the objective.

MITRE ATT&CK
Controls that should stop this
  • Egress controls and DLP on production and repository data
  • Alerting on bulk repository export and large data movement
  • Revocation and rotation triggered by any credential-exposure event
What defenders should see
  • Bulk repository export or clone volume
  • Large or unusual data egress from production
  • Access to many repositories or datasets in a short window
What a pentest validates
  • Attempt controlled, authorised exfiltration to test detection
  • Verify alerts fire on bulk export and large egress
  • Confirm revocation processes evict exposed credentials
Business impact

Intellectual property and customer data leave the organisation — a breach with commercial and supply-chain consequences.

ATT&CK techniques in this chain

T1078.004Valid Accounts: Cloud AccountsT1552.001Unsecured Credentials: Credentials In FilesT1567.002Exfiltration Over Web Service: Cloud StorageT1530Data from Cloud StorageT1195.002Supply Chain Compromise: Compromise Software Supply ChainT1213.003Data from Information Repositories: Code Repositories

If this chain completes

Exposure of source code, embedded secrets and — through CI/CD trust — the production environment itself, threatening intellectual property, customer data and software-supply-chain integrity.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths