--- title: Getting Rid of Shared Secrets: The Major Design Flaw of... description: Shared secrets stored in CI/CD systems like GitHub Actions and CircleCI create a major attack surface, since compromising the CI platform can expose long-lived... canonical: https://daily.dev/posts/getting-rid-of-shared-secrets-the-major-design-flaw-of-all-ci-systems-zv8ngundx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Getting Rid of Shared Secrets: The Major Design Flaw of All CI Systems | daily.dev og:description: Shared secrets stored in CI/CD systems like GitHub Actions and CircleCI create a major attack surface, since compromising the CI platform can expose long-lived... og:url: https://daily.dev/posts/getting-rid-of-shared-secrets-the-major-design-flaw-of-all-ci-systems-zv8ngundx og:image: https://api.daily.dev/og/posts/zv8ngUnDX.png og:image:alt: Getting Rid of Shared Secrets: The Major Design Flaw of All CI Systems og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Getting Rid of Shared Secrets: The Major Design Flaw of All CI Systems **[Teleport](https://daily.dev/sources/teleport)** · 10 min read · 0 upvotes · 0 comments ## Summary Shared secrets stored in CI/CD systems like GitHub Actions and CircleCI create a major attack surface, since compromising the CI platform can expose long-lived credentials to production systems. A design pattern using OpenID Connect (OIDC) identity tokens and short-lived SSH certificates is presented as a replacement: CI runners generate ephemeral keypairs, prove their identity via a JWT issued by the CI platform, and exchange it for a short-lived certificate signed by a certificate authority. Additional hardening techniques like IP pinning and TPM-backed key storage are discussed. The piece closes with a pitch for Teleport's open source Machine ID tool, which implements this certificate-based approach along with auditing and RBAC for SSH, databases, Kubernetes, and HTTP. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I use OIDC to eliminate long-lived SSH secrets in GitHub Actions CI pipelines? A CI runner generates an ephemeral SSH keypair, then presents its GitHub-issued OIDC ID token along with the public key to a certificate authority. The CA validates the JWT's signature, audience, expiry, and not-before claims plus the GitHub environment claim, then signs a short-lived SSH certificate, typically valid around half an hour, removing the need for a stored long-lived secret. _daily.dev surfaces practical write-ups like this for teams hardening CI/CD secret handling._ ### What claims should a certificate authority validate in a GitHub Actions OIDC ID token before issuing a certificate? The CA should check the 'aud' claim to confirm the token targets the CA service, the 'exp' claim to ensure it has not expired, and 'nbf' to ensure it is not used before its valid time. GitHub also includes an 'environment' claim (e.g., production) that can enforce workflow-specific rules like requiring a specific branch or admin approval before granting access. _Engineers securing pipelines can track OIDC and CI security patterns on daily.dev._ ### How does IP pinning protect stolen short-lived SSH certificates in CI workflows? IP pinning adds a 'source-address' critical option to the SSH certificate containing the client's IP address at issuance time. An OpenSSH server checks that the connecting IP matches this value before accepting the certificate, so even if an attacker steals the short-lived certificate and private key from a compromised workflow environment, it becomes unusable from a different network location. _daily.dev helps developers stay current on credential theft mitigations like IP pinning._ ## Similar posts on daily.dev - [Preventing secret leakage in CI/CD environments](https://daily.dev/posts/preventing-secret-leakage-in-ci-cd-environments-tveiielvq) · Security Boulevard · 2 upvotes · 0 comments - [How We Eliminated Long-Lived CI Secrets Across 70\+ Repos](https://daily.dev/posts/how-we-eliminated-long-lived-ci-secrets-across-70-repos-4qm6oazyn) · Pulumi · 0 upvotes · 0 comments - [Why short-lived systems need stronger identity governance](https://daily.dev/posts/why-short-lived-systems-need-stronger-identity-governance-2mp3kjrvi) · CSO Online · 0 upvotes · 0 comments - [You Can't Leak a Key You Never Held](https://daily.dev/posts/you-can-t-leak-a-key-you-never-held-v4tv2u8ax) · strongdm · 0 upvotes · 0 comments --- Tags: [#cicd](https://daily.dev/tags/cicd), [#authentication](https://daily.dev/tags/authentication), [#github-actions](https://daily.dev/tags/github-actions), [#ssh](https://daily.dev/tags/ssh), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/getting-rid-of-shared-secrets-the-major-design-flaw-of-all-ci-systems-zv8ngundx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Getting Rid of Shared Secrets: The Major Design Flaw of All CI Systems","url":"https://daily.dev/posts/getting-rid-of-shared-secrets-the-major-design-flaw-of-all-ci-systems-zv8ngundx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/getting-rid-of-shared-secrets-the-major-design-flaw-of-all-ci-systems-zv8ngundx"},"datePublished":"2026-08-23T12:23:03.338Z","dateModified":"2026-08-23T12:50:06.548Z","description":"Shared secrets stored in CI/CD systems like GitHub Actions and CircleCI create a major attack surface, since compromising the CI platform can expose long-lived...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/getting-rid-of-shared-secrets-the-major-design-flaw-of-all-ci-systems-zv8ngundx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cicd,authentication,github-actions,ssh,secrets-management","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Getting Rid of Shared Secrets: The Major Design Flaw of All CI Systems"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/getting-rid-of-shared-secrets-the-major-design-flaw-of-all-ci-systems-zv8ngundx#faq","mainEntity":[{"@type":"Question","name":"How can I use OIDC to eliminate long-lived SSH secrets in GitHub Actions CI pipelines?","acceptedAnswer":{"@type":"Answer","text":"A CI runner generates an ephemeral SSH keypair, then presents its GitHub-issued OIDC ID token along with the public key to a certificate authority. The CA validates the JWT's signature, audience, expiry, and not-before claims plus the GitHub environment claim, then signs a short-lived SSH certificate, typically valid around half an hour, removing the need for a stored long-lived secret. daily.dev surfaces practical write-ups like this for teams hardening CI/CD secret handling."}},{"@type":"Question","name":"What claims should a certificate authority validate in a GitHub Actions OIDC ID token before issuing a certificate?","acceptedAnswer":{"@type":"Answer","text":"The CA should check the 'aud' claim to confirm the token targets the CA service, the 'exp' claim to ensure it has not expired, and 'nbf' to ensure it is not used before its valid time. GitHub also includes an 'environment' claim (e.g., production) that can enforce workflow-specific rules like requiring a specific branch or admin approval before granting access. Engineers securing pipelines can track OIDC and CI security patterns on daily.dev."}},{"@type":"Question","name":"How does IP pinning protect stolen short-lived SSH certificates in CI workflows?","acceptedAnswer":{"@type":"Answer","text":"IP pinning adds a 'source-address' critical option to the SSH certificate containing the client's IP address at issuance time. An OpenSSH server checks that the connecting IP matches this value before accepting the certificate, so even if an attacker steals the short-lived certificate and private key from a compromised workflow environment, it becomes unusable from a different network location. daily.dev helps developers stay current on credential theft mitigations like IP pinning."}}]} ```