Skip to content

The 24 CircleCI security checks Black Cat runs

Black Cat SSPM evaluates 24 security policies against your CircleCI configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.

How to connect CircleCI — what access Black Cat needs, and why.

Access control & privilege (7)

Configuration hardening (14)

Other checks (3)

severity: medium Excessive Env Vars fix difficulty: medium #

Reduce project-level environment variables by migrating shared secrets to contexts or OIDC tokens

  1. Sign in to CircleCI and navigate to the affected project's settings
  2. Select "Environment Variables" from the left-hand navigation
  3. Review each variable and determine if it is shared across multiple projects
  4. Move shared secrets to a named context under Organization Settings > Contexts
  5. For cloud provider credentials, configure OIDC token authentication to eliminate long-lived keys
  6. Delete environment variables that have been migrated and confirm pipelines still pass

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: critical Pipeline Hardcoded Secrets fix difficulty: hard #

Remove hardcoded secrets from pipeline config and store them in CircleCI contexts or environment variables

  1. Identify the secret values exposed in the pipeline config (API keys, passwords, tokens)
  2. Immediately rotate each compromised credential with the issuing service
  3. Remove the hardcoded secret from .circleci/config.yml and commit the sanitized config
  4. Create a named context under Organization Settings > Contexts and add each secret as an environment variable
  5. Update the pipeline job to reference the context and use the environment variable instead of the literal value
  6. Audit git history and use a tool such as git-filter-repo to remove the secret from all previous commits

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: medium Orb Allowlist Empty fix difficulty: medium #

Configure an orb allowlist to restrict which third-party orbs pipelines may use

  1. Sign in to CircleCI and navigate to Organization Settings
  2. Select "Security" from the left-hand navigation
  3. Under "Orb Security Settings", locate the orb allow-list configuration
  4. Add each approved orb namespace or specific orb version to the allowlist
  5. Set the policy to block any orb not present on the allowlist
  6. Save changes and notify pipeline authors of approved orb sources

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.23 CIS Controls v8 CIS-15.1 NIST CSF 2.0 GV.SC GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial