Your pipeline needs credentials to deploy to production. How do you handle that safely?
What they are really testing: Whether you know that long-lived static credentials are the thing to eliminate, not just to hide. The senior answer is short-lived identity, not a better secret box.
A real interview question
Your pipeline needs credentials to deploy to production. How do you handle that safely?
What most people say
drag me
“Store them as encrypted secrets in the CI system.”
It is the baseline, not the answer. It leaves a long-lived credential that is valid until someone rotates it, and says nothing about scoping, fork protection, or log leakage, which is where real breaches happen.
The follow-ups they ask next
Why is a fork pull request specifically dangerous?
It runs attacker-controlled code. If secrets are exposed to PR builds, someone can open a PR that prints or exfiltrates them. Secrets must be restricted to trusted branches and environments.
A build argument was used for a token. Is deleting the layer enough?
No. Build args are recorded in image history and remain recoverable. Treat the token as compromised and rotate it, then rebuild using a secret mount instead.
What the interviewer is listening for
- Reaches for short-lived federated credentials first
- Raises fork PR risk
- Knows build args persist in image history
What sinks the answer
- Stops at "encrypted CI secret"
- Would use a personal access token
- No rotation or audit story
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Ideally [no stored secret at all: federate identity and exchange for short-lived credentials]. Otherwise [a dedicated least-privilege deploy identity], [bound to protected branches so forks cannot reach it], [masked in logs and never a build arg], and [rotated automatically].”
Keep going with security
Mid
Your vulnerability scanner reports 200 CVEs in a production image. How do you handle it?
Mid
How would you rotate a database password used by 12 running services with no downtime?
Mid
Your deploy role has full administrator access because narrowing it kept breaking things. How do you fix that properly?
Senior
Compliance requires that every production change is approved and auditable. How do you keep deploying daily?
Senior
How would you protect your build pipeline from a supply chain attack?
Junior
Design the pipeline for a typical web application. What stages would you have, and in what order?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free