Principle
Keep CI agents away from production secrets they do not need
A pull request can become an instruction channel to a privileged deputy.
When it fits
- An AI review or fix bot runs on pull-request content with broad CI credentials.
When to avoid it
- CI products differ in isolation model; inspect the actual runner, token and secret rules.
Why it matters
Give AI-powered CI jobs the minimum token permissions and secrets required for their narrow function. Isolate them from deployment credentials where possible, especially on externally influenced PRs. Separate review/comment capability from push, workflow-edit and deploy capability.
An example
A PR review bot can read the diff and comment but cannot access production cloud credentials or modify deployment workflows.
Check your result
A malicious PR cannot obtain high-impact capability merely because an AI bot reads it.
Keep this limit in mind
- CI products differ in isolation model; inspect the actual runner, token and secret rules.
Connected ideas
Use beforeRequire a human decision before privileged workflow execution
Evidence and sources
OWASP's current secure-coding-with-AI guidance treats repository content, issues, PRs, comments, fetched pages, logs and tool responses as potential indirect prompt-injection inputs for coding agents.
Threat likelihood depends on who can influence the content and what permissions the agent has.
Secure Coding with AI Cheat Sheet · Indirect Prompt Injection in the Development Loop
OWASP treats rules files, build scripts, CI workflows and package lifecycle scripts as security-sensitive control surfaces that deserve heightened review when an agent changes them.
The exact sensitive-file set depends on the repository and build system.
Secure Coding with AI Cheat Sheet · Rules Files; Prompt-to-Code Supply Chain Risk