Prod tends to have less privileges than CI/CD. CI/CD tends to be full admin, so it's far more sensitive. Prod tends to have tooling for detecting breaches, better logging, etc. People tend to use containers, which act as a sandbox.

Prod also won't be wormable the way that CI/CD is. With CI/CD I can own another dev, use their creds to push another malicious build script, etc. "Attacker is in my prod env" isn't wormable.

Yes, capabilities in prod would be hugely beneficial but removing CI/CD is massive as a win.

▲

JustSkyfall an hour ago | parent [-]

Wouldn't the dropper get executed once tests are run within CI though?

▲

insanitybit 23 minutes ago | parent | next [-]

Yes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.

	▲	rcxdude 7 minutes ago \| parent [-]
		You can also do the same for the build workflow, no?

▲

jitl an hour ago | parent | prev [-]

yeah, or when a dev starts the local development server (unless that server is containerized).

	▲	insanitybit 21 minutes ago \| parent [-]
		Dev laptops tend to have better monitoring than CI/CD so I still think this is a better option. You can also have devs use VMs or separate dev environments like an ec2 instance. To be clear, just solving the CI/CD portion is insufficient, but it is a massive win.