Audited our CI last week: 4 long-lived cloud keys, one 3 years old, o…

Siddharth Saxena

AppSec Engineer @ Moneyleaf | OWASP, threat modeling, bug bounty | Making security developer-friendly

4 Oct 2026 DevOps & Cloud India

Audited our CI last week: 4 long-lived cloud keys, one 3 years old, one belonging to someone who left in 2024. Moved everything to OIDC federation (GitHub Actions → AWS role). No static keys left. Took one afternoon.

4 reactions2 comments

Comments

AN
Aditya Nair4 Oct 2026
OIDC federation is the best thing to happen to CI security.
KB
Karan Bhatia5 Oct 2026
Every audit I do finds the 'key from someone who left' situation 😬

Join the conversation

Join workOwon to react, comment and follow people and communities you care about.