[ponytech]

edit: Credentials for modifying the piepline were found in the .git/config file

[zettabomb]

With Bitbucket, as well as Gitlab and likely others that I haven't used, the CI pipelines are stored as a plaintext configuration in the repo itself. So, repo commit access automatically gives you the ability to modify the pipeline.

[lost_womble]

This is why things like codeowners files are so important

[matharmin]

It's right at the start of the post - the git remote including credentials was exposed via the .git directory