Secret-based cloud supply-chain attacks: Case study and lessons for security teams

This report outlines three overlooked CI/CD supply-chain risk patterns in cloud environments—overprivileged access to container registries, forgotten secrets left in build artifacts, and lateral movement paths between production and internal CI/CD systems—explaining attacker flows and providing mitigations. Recommended defenses include least-privilege controls on registries and Kubernetes service accounts, comprehensive secret scanning across image layers and logs (e.g., with Trufflehog), strong network segmentation and restricted access to CI/CD assets, and hardening SaaS CI/CD with MFA and RBAC.