Skip to content

CircleCI configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On CircleCI, Black Cat runs 14 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the CircleCI connector needs.

Checks (14)

severity: medium Config Policies Disabled fix difficulty: medium #

Enable config policies in CircleCI organization settings to enforce pipeline standards

  1. Sign in to CircleCI and navigate to Organization Settings
  2. Select "Config Policies" from the left-hand navigation
  3. Toggle "Enable config policy evaluation" to on
  4. Create or import a policy bundle to define your pipeline rules
  5. Set the enforcement level to "hard_fail" to block non-compliant pipelines
  6. Save changes and trigger a test pipeline to verify policy evaluation is active

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Config Policies Soft Fail fix difficulty: easy #

Switch config policy enforcement from soft_fail to hard_fail to block non-compliant pipelines

  1. Sign in to CircleCI and navigate to Organization Settings
  2. Select "Config Policies" from the left-hand navigation
  3. Open each active policy bundle and review the enforcement level setting
  4. Change the enforcement level from "soft_fail" to "hard_fail"
  5. Save the updated policy bundle
  6. Trigger a test pipeline to confirm non-compliant jobs are blocked rather than warned

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Forked PR Builds Enabled fix difficulty: easy #

Disable forked pull request builds to prevent untrusted code from accessing CI secrets

  1. Sign in to CircleCI and navigate to the affected project's settings
  2. Select "Advanced" from the left-hand navigation
  3. Locate the "Build forked pull requests" toggle
  4. Disable the toggle to stop building PRs from forks
  5. If external contributors are required, configure a gating step that requires approval before secrets are exposed
  6. Save changes and verify that a new fork-originated PR does not trigger a build automatically

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Webhook Insecure URL fix difficulty: easy #

Update CircleCI webhook URLs to use HTTPS to protect build event data in transit

  1. Sign in to CircleCI and navigate to Organization Settings or the affected project's settings
  2. Select "Webhooks" from the left-hand navigation
  3. Locate the webhook with an HTTP (non-HTTPS) URL
  4. Click "Edit" on the webhook and update the URL to begin with https://
  5. Ensure the receiving endpoint presents a valid TLS certificate
  6. Save the change and trigger a test event to confirm delivery succeeds over HTTPS

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Webhook Unverified TLS fix difficulty: easy #

Enable TLS certificate verification on CircleCI webhooks to prevent man-in-the-middle attacks

  1. Sign in to CircleCI and navigate to Organization Settings or the affected project's settings
  2. Select "Webhooks" from the left-hand navigation
  3. Click "Edit" on the webhook that has TLS verification disabled
  4. Enable the "Verify TLS certificate" option
  5. Ensure the receiving endpoint has a valid certificate from a trusted CA (not self-signed)
  6. Save the change and trigger a test event to confirm delivery succeeds with TLS verification on

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Stale Runner fix difficulty: medium #

Investigate and decommission self-hosted runners that have not contacted CircleCI in over 7 days

  1. Sign in to CircleCI and navigate to Organization Settings
  2. Select "Self-Hosted Runners" from the left-hand navigation
  3. Identify runners whose last contact timestamp is older than 7 days
  4. Check the host machine to determine if the runner agent process is still running
  5. If the machine is decommissioned or the runner is no longer needed, delete it from the CircleCI UI
  6. If the runner should be active, reinstall or restart the CircleCI runner agent on the host

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Schedule Non-Default Branch fix difficulty: easy #

Review scheduled pipelines targeting non-default branches and update to target the default branch if appropriate

  1. Sign in to CircleCI and navigate to the affected project's settings
  2. Select "Triggers" or "Scheduled Pipelines" from the left-hand navigation
  3. Locate the schedule configured to run on a non-default branch
  4. Assess whether the non-default branch target is intentional (e.g., a long-lived release branch)
  5. If the default branch should be the target, click "Edit" and update the branch parameter
  6. Save the change and verify the next scheduled run triggers against the correct branch

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Pipeline Deprecated Image fix difficulty: easy #

Replace deprecated circleci/ Docker images with maintained cimg/ equivalents in pipeline config

  1. Open the affected pipeline's .circleci/config.yml file in your source repository
  2. Search for Docker image references starting with "circleci/" (e.g. circleci/node, circleci/python)
  3. Replace each deprecated image with the corresponding cimg/ image (e.g. cimg/node, cimg/python)
  4. Pin the replacement image to a specific version tag to ensure reproducibility
  5. Commit the change and trigger a pipeline run to confirm the new image builds successfully
  6. Remove any workarounds added to compensate for the deprecated image's missing packages

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Webhook No Signing Secret fix difficulty: medium #

Configure a signing secret on CircleCI webhooks to verify payload authenticity

  1. Sign in to CircleCI and navigate to Organization Settings or the affected project's settings
  2. Select "Webhooks" from the left-hand navigation
  3. Click "Edit" on the webhook that has no signing secret
  4. Generate a strong random secret and enter it in the "Signing Secret" field
  5. Update your webhook receiver to validate the X-Circleci-Signature header using the shared secret
  6. Save the change and trigger a test event to confirm signature validation passes

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Pipeline Machine Executor fix difficulty: medium #

Replace machine executors with Docker executors to improve isolation between pipeline jobs

  1. Open the affected pipeline's .circleci/config.yml file in your source repository
  2. Identify jobs using machine executor configuration
  3. Evaluate whether the job truly requires full VM access (e.g., Docker builds, kernel-level testing)
  4. For jobs that do not require VM access, switch to a Docker executor with a specific cimg/ image
  5. For jobs that require Docker builds, use setup_remote_docker within a Docker executor instead
  6. Commit the change and verify the pipeline still passes with the new executor

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Pipeline Setup Remote Docker fix difficulty: medium #

Review usage of setup_remote_docker and ensure Docker-in-Docker is necessary for the pipeline

  1. Open the affected pipeline's .circleci/config.yml file in your source repository
  2. Identify steps using the "setup_remote_docker" command
  3. Evaluate whether Docker-in-Docker is required for the job (e.g., building container images)
  4. If Docker builds are not needed, remove setup_remote_docker to reduce the attack surface
  5. If Docker builds are required, ensure the remote Docker version is pinned to a specific version
  6. Consider using a dedicated build service like Docker Hub Automated Builds for image creation instead

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Excessive Orb Allowlist fix difficulty: medium #

Reduce the orb allowlist to only actively used and trusted orbs to limit supply chain risk

  1. Sign in to CircleCI and navigate to Organization Settings
  2. Select "Security" from the left-hand navigation
  3. Review each entry in the orb allowlist
  4. Cross-reference with actual orb usage across your organization's pipeline configs
  5. Remove any orbs that are no longer used or come from untrusted sources
  6. Save the updated allowlist and verify no active pipelines are broken

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Runner Without Name fix difficulty: easy #

Assign a descriptive name to self-hosted runners to improve auditability

  1. Sign in to CircleCI and navigate to Organization Settings
  2. Select "Self-Hosted Runners" from the left-hand navigation
  3. Identify the runner with no name configured
  4. Access the host machine running the CircleCI runner agent
  5. Update the runner agent configuration to include a descriptive name identifying the host and purpose
  6. Restart the runner agent and verify the name appears in the CircleCI UI

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Schedule Without Description fix difficulty: easy #

Add a description to scheduled pipelines to document their purpose and ownership

  1. Sign in to CircleCI and navigate to the affected project's settings
  2. Select "Triggers" or "Scheduled Pipelines" from the left-hand navigation
  3. Locate the schedule that has no description
  4. Click "Edit" and add a description explaining the schedule's purpose, owner, and any relevant context
  5. Save the change

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More CircleCI checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial