Insufficient Flow Control Mechanisms (CICD-SEC-1 in the OWASP Top 10 CI/CD Security Risks) describe a pipeline in which a single actor-or an attacker who has gained a single foothold-can push code, configuration, or artifacts all the way to production without passing through an adequate set of checks, reviews, or gates. The vulnerability is not a bug in any one script; it is the absence of an enforced sequence of approvals between "someone changed something" and "that change is running in production."

Inadequate Identity and Access Management (IAM) is the risk that arises when the many identities-human and machine-spread across the CI/CD ecosystem are too numerous, over-permissioned, stale, or poorly governed. It is not a single misconfigured account; it is the accumulated failure to consistently answer three questions for every identity in the pipeline: who or what is this, exactly what may it do, and should it still exist at all?

Dependency Chain Abuse (CICD-SEC-3 in the OWASP Top 10 CI/CD Security Risks) covers every way an attacker can abuse how a build system fetches its software dependencies to trick that build into pulling a malicious package instead of-or in addition to-the intended one. The flaw is not in the dependency you chose; it is in the resolution and retrieval process that decides which artifact actually lands on the build agent.

Poisoned Pipeline Execution (PPE) is the risk that an attacker who can influence the definition of a CI/CD pipeline-or the files and commands that pipeline runs-gets their own code executed inside the pipeline. Once code runs inside the pipeline it inherits the pipeline's identity: its secrets, its cloud credentials, its registry tokens, its access to source and artifacts.

Pipeline-Based Access Controls (PBAC) are the permissions granted to the environment in which a pipeline runs-the runner or agent, and the identity, secrets, and network reach it carries while a job executes. Insufficient PBAC is the condition where that execution environment holds access far beyond what the specific job in front of it actually needs.

Insufficient Credential Hygiene (CICD-SEC-6 in the OWASP Top 10 CI/CD Security Risks) is the failure to properly handle the large volume of secrets that flow through a modern engineering pipeline. Every build, test, deploy, and release step needs credentials-cloud keys, registry tokens, database passwords, signing keys, SaaS API tokens-and each of those secrets is created, stored, passed between steps, printed, cached, and eventually (ideally) rotated.

Insecure System Configuration (CICD-SEC-7 in the OWASP Top 10 CI/CD Security Risks) is the risk that arises when the systems that build and ship software-source-control management (SCM) servers, continuous-integration servers, orchestrators, artifact registries, and build runners-are themselves run with insecure settings, left at unsafe defaults, exposed on the network, or allowed to fall behind on patches. The flaw is not in the application code moving through the pipeline; it is in the configuration and posture of the pipeline machinery itself.

Ungoverned Usage of 3rd Party Services is the risk that arises when your CI/CD ecosystem depends on a large number of external services and integrations that are granted access to your source code, build systems, and secrets-with little to no governance over who they are, what they can do, or whether they are still needed. It is not a single vulnerability in your code; it is the accumulated, unmonitored trust you have extended to third parties whose security posture you neither control nor observe.

Improper Artifact Integrity Validation occurs when a delivery pipeline consumes and ships an artifact-source, a dependency, a container image, a build output, an IaC plan-without verifying that it is exactly the artifact that was supposed to be produced, by the process that was supposed to produce it. Every step in a CI/CD pipeline is a hand-off: source moves from SCM to the CI runner, dependencies are pulled from registries, build outputs are pushed to an artifact store, and a deployer pulls those outputs into production.

Insufficient Logging and Visibility is the tenth risk in the OWASP Top 10 CI/CD Security Risks. It describes a CI/CD environment that lacks the logging, monitoring, and detection needed to notice an attack in the pipeline.