Learn about CI/CD security, DevOps best practices, and governance guides to secure your pipelines.

We graded 15k+ public GitHub and GitLab pipelines with the open-source Plumber CLI: 68% sit at E, 54% carry a Critical finding, and the most-starred projects grade among the worst. CI/CD is still the blind spot of software security.

Plumber CLI 0.4 adds nine new supply-chain and secret-exposure controls, makes the Plumber Score the build gate, and ships a CI-native score-push badge.

Plumber Score is a free, open-source A-E security grade for CI/CD pipelines: the unwatched stage AI is flooding with more code and more automated attacks. Publish yours, and check your dependencies' scores before trusting what they ship.

checkout v7 refuses, by default, to fetch a fork's ref under pull_request_target, blocking the pwn request natively. The protection is backported to all supported majors on July 16, 2026, so floating tags inherit it automatically. Here is what changes, the allow-unsafe-pr-checkout exception to watch, and why almost every repository is affected.

OIDC removes static cloud credentials, but not the temporary credentials exposed while the runner executes. Megalodon is a reminder of the layers to stack around it: a strict trust policy, protected environments, least-privilege permissions, egress control, and workflow governance.

Introducing Plumber 1.4: bulk issue owner management with search, one-click auto-fix for merge request settings, and AWS Bedrock API key support.

Plumber CLI 0.3 adds GitHub Actions scanning, 14 GitHub controls, schema v2 configuration, and the same compliance workflow you already use on GitLab

What we found when we ran the open-source Plumber CLI against hundreds of public GitLab projects: the average pipeline grades a C, hardcoded jobs are almost universal, and 1 in 5 ships Docker-in-Docker.

Plumber CLI and GitLab component 0.2: new scoring model, new commands, catalog updates, and fixes

Introducing Plumber 1.3: a more resilient analysis process, sensitive data redaction in logs, and various improvements

French newspaper Libération uses Plumber to map its CI/CD pipelines, standardize configurations, and fix security gaps across every project.

Numspot is building a sovereign cloud where pipelines must be secure by design. How the team uses Plumber to find and fix CI/CD security gaps at scale.

FDI Access uses Plumber to secure its CI/CD pipelines and produce audit-ready evidence for VIGIK+ and ISO 27001 without slowing delivery down.

A step-by-step guide to adding SLSA provenance, OpenSSF Scorecard, SHA-pinned actions, least-privilege tokens, and more to your open-source project.

Checklist and controls for audit-ready CI/CD compliance (ISO 27001, NIS2, DORA, CRA). Examples, evidence, drift detection, and remediation at scale.

Introducing Plumber 1.1: portfolio compliance details, and various improvements

How we added SLSA Level 3 provenance, OpenSSF Scorecard monitoring, and OpenSSF Best Practices to Plumber, and what each of these frameworks actually means for open-source security.

An AI bot compromised 5 of 7 major repos in one week via CI/CD misconfigurations. A call to govern, not patch. Why CI/CD compliance and pipeline governance must become standard.

Point Base runs more than 1,000 pipelines a month. How Plumber helps the team spot CI/CD security issues early and cut maintenance overhead.

A hands-on walkthrough of using Plumber to scan your GitLab CI/CD pipelines for compliance issues from install to continuous monitoring in under 5 minutes.

Introducing Plumber 1.0: a fresh identity, enhanced user activity tracking, and chart time range customization

Shai-Hulud 2.0 is a massive supply chain attack targeting CI/CD pipelines via malicious npm packages. Learn how to detect it and secure your GitLab & GitHub workflows immediately.

Critical security alert: Learn about the TJ Actions supply chain attack and how to protect your GitLab CI/CD pipelines from similar threats.

Plumber est lauréat du programme France 2030 – NCC-FR Cyber, opéré par Bpifrance et l'ANSSI, pour accélérer la sécurisation des pipelines CI/CD.

Explore the top 5 software supply chain security incidents, including the SolarWinds attack and Codecov breach. Learn how these high-profile breaches highlight critical security vulnerabilities and best practices to protect your software supply chain