12 June 2026
Where CI/CD audits usually find the first crack
Personal access tokens in deploy jobs, label-based bypasses, and shared variable groups still dominate early findings.
Most pipeline audits begin with inventory, not philosophy. Before anyone debates trunk-based versus GitFlow, we list the jobs that can touch production and ask a blunt question: who can run them, and with what credentials?
Leftover human tokens
Deploy jobs that still authenticate with a personal access token from a former contractor remain surprisingly common. The YAML looks intentional; the ownership trail does not. Rotation policies that cover cloud IAM sometimes never mention CI secrets.
Skip labels that became culture
A temporary skip-tests label created for a demo weekend becomes the Friday afternoon escape hatch. Audits treat this as a process finding as much as a technical one: the pipeline is honest about what it will skip; the organization may not be honest about how often that happens.
One variable group for two worlds
Staging and production variables that differ only by a suffix in the same group make copy-paste mistakes cheap. Splitting groups is tedious and usually worth the first week of remediation.
If you recognize these patterns, a structured pipeline audit is often a better starting point than buying another dashboard.