Learn about CI/CD compliance, DevOps best practices, and governance guides to secure your pipelines.

Introducing Plumber 1.4: bulk issue owner management with search, one-click auto-fix for merge request settings, and AWS Bedrock API key support.

Plumber CLI 0.3 adds GitHub Actions scanning, 14 GitHub controls, schema v2 configuration, and the same compliance workflow you already use on GitLab

What we found when we ran the open-source Plumber CLI against hundreds of public GitLab projects: the average pipeline grades a C, hardcoded jobs are almost universal, and 1 in 5 ships Docker-in-Docker.

Plumber CLI and GitLab component 0.2: new scoring model, new commands, catalog updates, and fixes

Introducing Plumber 1.3: a more resilient analysis process, sensitive data redaction in logs, and various improvements

Libération: Bringing Clarity and Standardization to CI/CD Pipelines

Numspot: Building a Sovereign Cloud with Secure & Compliant CI/CD by Design

FDI Access: Proving CI/CD Compliance for VIGIK+ and ISO 27001

A step-by-step guide to adding SLSA provenance, OpenSSF Scorecard, SHA-pinned actions, least-privilege tokens, and more to your open-source project.

Checklist and controls for audit-ready CI/CD compliance (ISO 27001, NIS2, DORA, CRA). Examples, evidence, drift detection, and remediation at scale.

Introducing Plumber 1.1: portfolio compliance details, and various improvements

How we added SLSA Level 3 provenance, OpenSSF Scorecard monitoring, and OpenSSF Best Practices to Plumber, and what each of these frameworks actually means for open-source security.

An AI bot compromised 5 of 7 major repos in one week via CI/CD misconfigurations. A call to govern, not patch. Why CI/CD compliance and pipeline governance must become standard.

Point Base: Securing 1k+ Monthly Pipelines & Cutting CI/CD Overhead with Plumber

A hands-on walkthrough of using Plumber to scan your GitLab CI/CD pipelines for compliance issues from install to continuous monitoring in under 5 minutes.

Introducing Plumber 1.0: a fresh identity, enhanced user activity tracking, and chart time range customization

Shai-Hulud 2.0 is a massive supply chain attack targeting CI/CD pipelines via malicious npm packages. Learn how to detect it and secure your GitLab & GitHub workflows immediately.

Critical security alert: Learn about the TJ Actions supply chain attack and how to protect your GitLab CI/CD pipelines from similar threats.

Plumber est lauréat du programme France 2030 – NCC-FR Cyber, opéré par Bpifrance et l'ANSSI, pour accélérer la sécurisation des pipelines CI/CD.

Explore the top 5 software supply chain security incidents, including the SolarWinds attack and Codecov breach. Learn how these high-profile breaches highlight critical security vulnerabilities and best practices to protect your software supply chain