Your CI/CD Pipeline Knows More About Your Codebase Than You Do
Continuous integration and continuous deployment pipelines execute every commit, run every test, build every artifact, and log every failure. Over months and years, a CI/CD system accumulates more knowledge about a codebase than any individual developer. It knows which files break most often, which tests are unreliable, which authors introduce the most regressions, and which hours of the day produce the worst code. This data is a surveillance record of engineering behavior. It is unencrypted. It is unregulated. It is accessible to anyone with pipeline admin access. This paper documents what CI/CD systems actually record, who can access that data, and how it could be weaponized against individual developers. It proposes a framework for pipeline data governance that preserves operational value while protecting developer privacy.
Read paper →