World map

 

BM

World C4: Pipeline Shields

Why pipelines are targets

You will learn: why attackers aim at your pipeline, and the main ways in.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

Your conveyor belt can open the locked spice box. It ships to customers every day. A thief wants your keys. Where would they aim?

Watch

Tap every line that hands this job a key.

0 of 3 found

Count the keys. Each secret: The locked spice box: private info like a token. Never put it in code. opens a door. This one job can change your code, your package and your live site.

Watch

Tap each point on the timeline.

Every action you borrow is a supplier. Poison one supplier, and every kitchen that uses it gets sick. This is a supply chain attack: A poisoned ingredient from a supplier: attackers break into a tool that many pipelines borrow..

Try it

This world gives you one shield for each hole. Sort these habits now. You will meet each one again.

Drag a card into a box. Or tap the card, then tap the box.

      Predict

      A borrowed action gets hacked. Your job has permissions: write-all. What can the attacker do?

      Check

      Attackers have a few ways onto the belt. Safe, or a way in? Swipe each one.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      A borrowed action whose owner was hacked

      You did it!

      You can now explain why attackers aim at pipelines.

      Go deeper (optional)

      Real rep (optional): open one workflow in your own repo. Count its secrets. Find its permissions: line. No line at all? Lesson 4 shows why to add one. Next lesson: a real attack from March 2025.