Variable is not scoped to an environment

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_74
Category	Credential Hygiene
Severity	MEDIUM

Impact

Repository CI/CD environment variables in projects and groups can be scoped to project environments in order to limit access of pipelines to them. Sensitive variables that are not scoped can be accessed by in secure pipelines (for example, on test environments), without proper controls on accessing these variables.

Recommended Solution - Buildtime

To limit a variable scope:

1. Browse to the relevant project or group Settings.
2. Under CI/CD, expand Variables.
3. Edit the environment variable and assign it to an environment scope.