Azure DevOps Pipeline Security and Secrets Review
Defensive review of pipeline configuration and access.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Review my pipeline setup as a defensive check of systems my team owns. Pipeline YAML or settings description: [PIPELINE_DESCRIPTION]. Service connections and their scopes: [SERVICE_CONNECTIONS]. Variable groups and where secrets are stored (names only): [VARIABLES]. Who can edit pipelines and approve deployments: [PERMISSIONS]. Check for secrets in plain text, broad service connection scopes, pipelines editable by many people, missing approvals for production, unpinned task or image versions, and logs that could expose values. Rank findings by how easily someone with ordinary access could exploit them and how much damage would follow, in plain terms. For each, describe the fix and the safe order of steps, for example rotating a credential before removing the old one. Do not ask me to paste secret values and do not include exploit instructions. Mark platform specifics [VERIFY]. Provide a quarterly checklist and a plan, handled by the owner, to rotate any credential that may have been exposed.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.