xDuct: CI/CD Pipeline Secret Security

The Problem

CI/CD runners are the #1 attack surface for supply chain compromise. The CircleCI breach in 2023 exposed all customer secrets. The CodeCov breach modified a bash uploader to exfiltrate credentials. Runners have full, unguarded access to every secret they need.

Every CI/CD pipeline stage — build, test, deploy — receives complete secrets as environment variables. A compromised build runner can read the deploy key. A tampered test container can harvest database credentials. The blast radius of any single runner compromise is total.

OIDC federation and short-lived tokens reduce exposure windows but do not solve the fundamental problem: at execution time, the secret exists complete and in cleartext in the runner's memory. Memory-scraping attacks, process injection, and compromised base images all bypass token scoping.

The Old Way

The PRIVATE.ME Solution

xDuct splits each pipeline secret into K-of-N shares distributed across stages and runners. The build stage receives Share 1. The deploy stage receives Share 2. Reconstruction happens only at the step that needs the complete secret, and only for the duration of that step.

Secrets are split before they enter the pipeline. Each runner receives shares, not secrets. A compromised build runner captures a share that reveals zero information about the deploy key. Even if an attacker controls K-1 runners, they learn nothing about any secret.

The New Way

Architecture

xDuct integrates with GitHub Actions, GitLab CI, and any CI system that supports custom secret injection. Secrets are split at configuration time and reconstructed at execution time.

Use Cases

Integration

import { splitSecret, reconstructForStep } from '@private.me/xduct';

// Split deploy key across 3 pipeline stages
const shares = await splitSecret('DEPLOY_KEY', {
  k: 2, n: 3,
  stages: ['build', 'test', 'deploy']
});

// At deploy step: reconstruct from available shares
const key = await reconstructForStep(shares, 'deploy', {
  available: ['build', 'deploy'],
  threshold: 2
});
// key available in memory for this step only

Security Properties

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xDuct?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xDuct generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases