A county continuous-integration portal similar to Jenkins is reachable from the internet with weak password-only auth. How should the tester prioritize it?
Select an answer to reveal the explanation.
Short Explanation
A CI box with a flimsy lock is the master key factory sitting on the sidewalk. Build systems often hold secrets, deploy rights, and code trust. Internet exposure plus weak auth jumps the priority queue.
Full Explanation
DevOps and CI/CD consoles frequently store credentials, signing material, and deployment authority, so internet exposure with weak authentication is a critical common-application finding. Prioritize access restriction, strong MFA, network controls, and secret hygiene. Scope is not limited by certificate sharing with the marketing site. Cosmetic or security.txt issues do not outrank this exposure.