Your CI/CD Pipeline Is the Easiest Way Into Your Repo (And Nobody's Checking It)

Your code gets reviewed. Your dependencies get scanned. But your CI/CD pipeline — the thing with access to your secrets, your deployments, and your production credentials — usually gets copy-pasted fr