---
title: "Keep secrets out of builds from strangers · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/supply-chain/ci-secrets
id: APS-74
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1081
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep secrets out of builds from strangers

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-74
- Level: Required
- Chapter: [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)
- Rule: Never give deploy keys or other secrets to builds that run code from outside contributors. Give each build job only the access it needs.
- Check: Open a test pull request from a fork that prints the environment. No secret appears in the log. A search of the workflows finds no `pull_request_target` job that checks out the pull request's code, and every action is pinned to a 40-character hash.
- Risk: An account or system taken over
- How: Run pull requests from forks without secrets. Never check out or run a fork's code in a job that has secrets, such as a GitHub `pull_request_target` job. Keep deploy keys in protected environments that only the main branch can use. Prefer short-lived cloud tokens through OIDC over stored keys. Pin build actions to a full commit hash, as [Lock every CI action and its dependencies to a reviewed commit](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/ci-dependency-lock.md) says. Give the build token read-only access unless a job needs more.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
permissions:
  contents: read
jobs:
  deploy:
    if: github.ref == 'refs/heads/main'
    environment: production
```

## Sources

- [GitHub Actions secure use reference](https://docs.github.com/en/actions/reference/security/secure-use)

## Related rules

- AID-22 [Have someone other than the requester approve agent changes](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/independent-approval.md) in AI-assisted development
- AID-29 [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers.md) in AI-assisted development
- ENG-16 [Run the checks on every change](https://agentwranglers.se/playbook/engineering/version-control-and-review/continuous-integration.md) in Engineering
- ENG-41 [Keep untrusted text out of CI scripts](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/ci-script-injection.md) in Engineering
- ENG-56 [Run outside code only on runners that are wiped after each job](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/ephemeral-ci-runners.md) in Engineering
- MOB-8 [Sign release builds only in CI](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/sign-in-ci.md) in Mobile apps
- OSS-10 [Review build files and test data in every outside change](https://agentwranglers.se/playbook/open-source/contributions/review-hidden-changes.md) in Open source maintenance
- OSS-30 [Run the OpenSSF Scorecard every week](https://agentwranglers.se/playbook/open-source/project-supply-chain/openssf-scorecard.md) in Open source maintenance
- ENG-55 [Lock every CI action and its dependencies to a reviewed commit](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/ci-dependency-lock.md) in Engineering

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/supply-chain/ci-secrets">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Fetch private packages only from your own registry](https://agentwranglers.se/playbook/application-security/supply-chain/dependency-confusion.md)
- Next: [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md)
- [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)