Blog
Learn about CI/CD security, DevOps best practices, and governance guides to secure your pipelines.
Workflow lockfiles make GitHub Actions run the commit recorded in your repository instead of whatever a tag points to today. We tested 29 scenarios to see what GitHub enforces at run time, what gh actions-lock --verify catches in CI, and the gaps that remain.
litellm 1.107.0 shipped files that are not in its git tag. PyPI quarantined it the same day. How to check your pipelines and what to rotate.
My customer's GitHub Actions pipeline passed every run for six weeks while a compromised third-party action shipped their source code and secrets to an attacker's server. Here is the true story behind Plumber, how a moved tag turned a trusted action into an exfiltration tool, and how to find the same attack path in your own pipeline in 30 seconds.
Introducing Plumber 1.5: portfolios that follow your GitLab groups automatically, and policies you can narrow by technology or topic.
We graded 15k+ public GitHub and GitLab pipelines with the open-source Plumber CLI: 68% sit at E, 54% carry a Critical finding, and the most-starred projects grade among the worst. CI/CD is still the blind spot of software security.
Plumber CLI 0.4 adds nine new supply-chain and secret-exposure controls, makes the Plumber Score the build gate, and ships a CI-native score-push badge.
Plumber Score is a free, open-source A-E security grade for CI/CD pipelines: the unwatched stage AI is flooding with more code and more automated attacks. Publish yours, and check your dependencies' scores before trusting what they ship.
checkout v7 refuses, by default, to fetch a fork's ref under pull_request_target, blocking the pwn request natively. The protection is backported to all supported majors on July 16, 2026, so floating tags inherit it automatically. Here is what changes, the allow-unsafe-pr-checkout exception to watch, and why almost every repository is affected.
OIDC removes static cloud credentials, but not the temporary credentials exposed while the runner executes. Megalodon is a reminder of the layers to stack around it: a strict trust policy, protected environments, least-privilege permissions, egress control, and workflow governance.
Introducing Plumber 1.4: bulk issue owner management with search, one-click auto-fix for merge request settings, and AWS Bedrock API key support.
Plumber CLI 0.3 adds GitHub Actions scanning, 14 GitHub controls, schema v2 configuration, and the same compliance workflow you already use on GitLab
What we found when we ran the open-source Plumber CLI against hundreds of public GitLab projects: the average pipeline grades a C, hardcoded jobs are almost universal, and 1 in 5 ships Docker-in-Docker.
Plumber CLI and GitLab component 0.2: new scoring model, new commands, catalog updates, and fixes
Introducing Plumber 1.3: a more resilient analysis process, sensitive data redaction in logs, and various improvements
French newspaper Libération uses Plumber to map its CI/CD pipelines, standardize configurations, and fix security gaps across every project.
Numspot is building a sovereign cloud where pipelines must be secure by design. How the team uses Plumber to find and fix CI/CD security gaps at scale.
FDI Access uses Plumber to secure its CI/CD pipelines and produce audit-ready evidence for VIGIK+ and ISO 27001 without slowing delivery down.
A step-by-step guide to adding SLSA provenance, OpenSSF Scorecard, SHA-pinned actions, least-privilege tokens, and more to your open-source project.
Checklist and controls for audit-ready CI/CD compliance (ISO 27001, NIS2, DORA, CRA). Examples, evidence, drift detection, and remediation at scale.
Introducing Plumber 1.1: portfolio compliance details, and various improvements
How we added SLSA Level 3 provenance, OpenSSF Scorecard monitoring, and OpenSSF Best Practices to Plumber, and what each of these frameworks actually means for open-source security.
An AI bot compromised 5 of 7 major repos in one week via CI/CD misconfigurations. A call to govern, not patch. Why CI/CD compliance and pipeline governance must become standard.
Point Base runs more than 1,000 pipelines a month. How Plumber helps the team spot CI/CD security issues early and cut maintenance overhead.
A hands-on walkthrough of using Plumber to scan your GitLab CI/CD pipelines for compliance issues from install to continuous monitoring in under 5 minutes.
Introducing Plumber 1.0: a fresh identity, enhanced user activity tracking, and chart time range customization
Shai-Hulud 2.0 is a massive supply chain attack targeting CI/CD pipelines via malicious npm packages. Learn how to detect it and secure your GitLab & GitHub workflows immediately.
Critical security alert: Learn about the TJ Actions supply chain attack and how to protect your GitLab CI/CD pipelines from similar threats.
Plumber est lauréat du programme France 2030 – NCC-FR Cyber, opéré par Bpifrance et l'ANSSI, pour accélérer la sécurisation des pipelines CI/CD.
Explore the top 5 software supply chain security incidents, including the SolarWinds attack and Codecov breach. Learn how these high-profile breaches highlight critical security vulnerabilities and best practices to protect your software supply chain
