ci-cd-security

A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.

GPU-accelerated secret scanner for code, Git history, containers, cloud, browser assets, and CI. 923 detectors, live verification, CUDA, Metal, WGPU.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.

Open source attack-path engine for AWS and Kubernetes: correlates your scanners into one graph and blocks the pull request that opens a route to your data.

Defensive static analysis and detection engineering for the 2026 Shai-Hulud npm supply-chain campaign: Sigma/YARA rules, IOCs, ATT&CK mapping, and defender guidance.

Language-agnostic software supply-chain security scanner covering 28 ecosystems. Detects malicious packages, suspicious code, install-time threats, secrets and AI-agent security risks before execution

Multi-gate open source supply chain trust validation pipeline with zero-day CVE expedited lane

Comprehensive guide for configuring Role-Based Access Control (RBAC) in Jenkins using the Role Strategy Plugin.

Go supply chain security analysis – finds vulnerabilities, weak maintainers, typosquatting, and CI/CD risks. SBOM + enterprise PDF reports.

Offline Jenkins credential decryption tool for post-exploitation, red team operations, and CTFs. Decrypts credentials.xml using master.key and hudson.util.Secret without a running Jenkins instance. Supports legacy and modern encryption formats, with Docker and cross-platform support

Jenkins plugin for Xygeni - End to end software development and delivery security

Git-native secrets manager for teams and AI agents: age encryption, deterministic diffs, leak prevention, secure runtime injection. Dual-licensed MIT OR Apache-2.0.

Audits Git repository configurations, commit history secret leaks, GitHub Actions .github/workflows/*.yml files, branch protection rules, and unpinned third-party action tags for script injection and GITHUB_TOKEN over-privilege.

Cryptographic proof of how an artifact was built, not just that it wasn't tampered with. Hands-on lab comparing Cosign signing vs SLSA Level 3 provenance using GitHub Actions, slsa-github-generator and slsa-verifier - including a forged-provenance attack demo.

Curated list of tools, research and guidance for securing and reviewing GitHub Actions workflows

Talk materials for "Your Agent Escaped Without Escaping the Sandbox" (Zenity AI Agent Security Summit, NYC, Oct 2026): deck, script, paper, scripted-agent lab.

Production-grade DevSecOps pipeline with automated vulnerability scanning

Interactive Terraform and OpenTofu plan visualizer, blast-radius inspector, pre-flight security linter, and PR summary reporter.

Pre-clone repo security scanner. Detects obfuscated payloads, hardcoded secrets, Unicode tricks, typo-squatting, CI/CD abuse, and supply-chain attacks before you clone.

A production-style DevSecOps CI/CD pipeline demonstrating shift-left security with open-source tools. It performs SAST, secrets detection, dependency and container scanning, SBOM generation, and image signing before deploying to Kubernetes. The pipeline can run locally or via GitHub Actions and generates security reports for validation.