Credential Scoping

Credentials are scoped to the folder or job that needs them, not stored globally.

A globally-scoped credential is available to every job on the controller, whether or not that job needs it — which means a single compromised or misconfigured pipeline can reach far more than it should. Folder- or job-scoped credentials limit the blast radius of that failure to the pipeline that actually holds the risk.

Related

• Homebridge: child bridges for anything flaky — the same blast-radius instinct, applied to home automation instead of CI credentials.