The source of everything

The article explains how attackers can abuse misconfigured CI/CD systems to access and exfiltrate source code, and provides a structured DFIR playbook that uses GitLab CE and Jenkins CI logs to reconstruct initial access, credential abuse, persistence, execution, collection, and exfiltration. It enumerates key evidence sources (e.g., GitLab production_json, application_json, api_json, and Nginx logs; Jenkins access logs, job logs, config and backup files), shows example log patterns for logins, failed logins, user and token creation, repository cloning, job starts, workspace access, and artifact downloads, highlights GitLab’s superior logging granularity versus Jenkins’ gaps, and concludes with SOC-oriented recommendations for monitoring, least privilege, secrets management, password policies, log forwarding to SIEM, and patch/secure configuration to prevent and investigate source code compromise.