> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-integration/3.0/use-harness-ci/secure-harness-ci/security-hardening.md).

# Security hardening for Harness CI

Harness offers features that help you build securely with Harness CI. Combine these features with known industry best practices.

The information is targeted at Harness CI. It is not a comprehensive explanation of all security features and capabilities throughout all Harness products, such as [Harness STO](https://app.gitbook.com/s/na57sNwixrWxOX8cOMRg/README).

### Access control <a href="#access-control" id="access-control"></a>

[Harness RBAC](/harness-ai/use-harness-platform/platform-access-control.md) helps you control access to your Harness account, organizations, and projects. For [authentication](/harness-ai/use-harness-platform/authentication.md), Harness supports SSO and 2FA log-in methods, as well as SAML authentication through various IDPs.

### Branch protection and PR checks <a href="#branch-protection-and-pr-checks" id="branch-protection-and-pr-checks"></a>

Failed CI pipelines don't inherently block PR merges. Harness can [send pipeline statuses to your PRs](/continuous-integration/3.0/use-harness-ci/use-harness-ci/codebase-configuration/scm-status-checks.md), but you must configure branch protections and checks (such as protection rules, CODEOWNERS, linting, and other checks or restrictions) *in your source control provider*.

### SLSA <a href="#slsa" id="slsa"></a>

With Harness CI, you can use the [Harness Supply Chain Security (SCS) module](https://app.gitbook.com/s/SN2B2M5cFWy0hhD0xTuE/README) to generate, manage, store, and enforce SBOM and SLSA Provenance.

You can also [run scripts in Run steps](/continuous-integration/3.0/use-harness-ci/use-harness-ci/run-step-settings.md) to generate SBOM and SLSA Provenance, and then [upload those artifacts](/continuous-integration/3.0/use-harness-ci/use-harness-ci/build-and-upload-artifacts/build-and-upload-an-artifact.md#upload-artifacts).

### Secrets <a href="#secrets" id="secrets"></a>

Store tokens, passwords, and other sensitive data as [secrets](/harness-ai/use-harness-platform/secrets.md) and then [use expressions to reference secrets](/harness-ai/use-harness-platform/secrets/add-file-secrets.md#reference-an-encrypted-file-secret) in your pipelines. For example, you can use an expression as the value for a variable:

```
APP_STORE_PASSWORD=<+secrets.getValue("my_app_store_password_secret")>
```

When you use secrets and variables in your CI pipelines, it is important to understand how those secrets appear in build logs. For example, secrets in [Run step output variables](/continuous-integration/3.0/use-harness-ci/use-harness-ci/run-step-settings.md#output-variables) are exposed in logs. For information about secrets masking and sanitization, go to:

* [Secrets in output, secrets sanitization](/harness-ai/use-harness-platform/secrets/add-file-secrets.md#secrets-in-outputs)
* [Line breaks and shell-interpreted characters](/harness-ai/use-harness-platform/secrets/add-file-secrets.md#line-breaks-and-shell-interpreted-characters)
* [Secrets and log sanitization](/harness-ai/use-harness-platform/secrets/secrets-management/secrets-and-log-sanitization.md)

For more information about managing secrets in Harness, go to:

* [Secrets documentation](/harness-ai/use-harness-platform/secrets.md)
* [Authenticate GCP secrets in scripts](/continuous-integration/use-harness-ci/secure-harness-ci/authenticate-gcp-key-in-run-step.md)
* [Override secrets in settings.xml at runtime](/continuous-integration/3.0/troubleshooting-and-resources/ci-articles-and-faqs/articles/maven-settings-xml.md)

### Tokens and keys <a href="#tokens-and-keys" id="tokens-and-keys"></a>

Harness APIs use Harness API keys and tokens to authenticate requests. Make sure to create tokens with the appropriate permission scopes. Tokens inherit permissions from the account used to create them. For more information, go to [Manage API keys](/harness-ai/use-harness-platform/automation/api/add-and-manage-api-keys.md).

You can store tokens and keys from non-Harness providers as [secrets in Harness](#secrets). Harness provides information about required permissions for third-party tokens and keys when relevant, such as authentication credentials for [Git connectors](/harness-ai/use-harness-platform/connectors/code-repositories/connect-to-code-repo.md#code-repo-connector-permissions-and-access); however, this is limited to the permissions necessary for successful integration with Harness.

For information about creating keys/tokens for a specific provider or tool, refer to the documentation for that provider or tool.

### Network security <a href="#network-security" id="network-security"></a>

For network security and private networking, Harness offers features such as:

* [IP allowlists](/harness-ai/use-harness-platform/security/add-manage-ip-allowlist.md)
* [Private network connectivity options](/harness-ai/use-harness-platform/references/private-network-connectivity/private-network-connectivity.md)
* [OIDC](#oidc)

### OIDC <a href="#oidc" id="oidc"></a>

You can use OpenID Connect (OIDC) with Harness CI.

With Harness Cloud, you can leverage the [OIDC connectivity mode](/harness-ai/use-harness-platform/connectors/cloud-providers/ref-cloud-providers/gcs-connector-settings-reference.md#use-openid-connect-oidc) in your [GCP connectors](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp.md). You can then use OIDC-enabled GCP connectors in GCP-related steps, such as the [Build and Push to GAR step](/continuous-integration/3.0/use-harness-ci/use-harness-ci/build-and-upload-artifacts/build-and-push/build-and-push-to-gar.md). You can also [Configure OIDC with GCP WIF for builds on Harness Cloud](/continuous-integration/use-harness-ci/secure-harness-ci/configure-oidc-gcp-wif-ci-hosted.md).

Not all step types support GCP connectors. However, you might need to perform operations with OIDC in steps that don't support GCP connectors. For example, if you use a Run step to pull artifacts from GAR with OIDC, you need the OIDC token in the Run step to successfully pull the artifact. In these cases, you can [use the GCP OIDC plugin to generate a GCP access token from an OIDC token](/continuous-integration/use-harness-ci/secure-harness-ci/gcp-oidc-token-plugin.md). Similarly, you can [use the Azure OIDC plugin to generate an Azure access token from an OIDC token](/continuous-integration/use-harness-ci/secure-harness-ci/azure-oidc-token-plugin.md) for authenticating with Azure services.

OIDC is also available in other areas of Harness, such as in the [platform-agnostic Kubernetes cluster connector](/harness-ai/use-harness-platform/connectors/cloud-providers/ref-cloud-providers/kubernetes-cluster-connector-settings-reference.md#openid-connect) and in other Harness modules.

### FAQ and troubleshooting <a href="#faq-and-troubleshooting" id="faq-and-troubleshooting"></a>

* [Can I reference a secret type output variable exported from a CD custom stage in a CI stage?](/continuous-integration/3.0/troubleshooting-and-resources/ci-articles-and-faqs/continuous-integration-faqs.md#can-i-reference-a-secret-type-output-variable-exported-from-a-cd-or-custom-stage-in-ci-stage)
* [Secrets with line breaks and shell-interpreted characters](/continuous-integration/3.0/troubleshooting-and-resources/ci-articles-and-faqs/continuous-integration-faqs.md#secrets-with-line-breaks-and-shell-interpreted-special-characters)
* [How to establish a VPN connection within a CI pipeline?](/continuous-integration/3.0/troubleshooting-and-resources/ci-articles-and-faqs/continuous-integration-faqs.md#how-to-establish-a-vpn-connection-within-a-ci-pipeline)