# Plumber

> Plumber is an open-source tool that maps your CI/CD pipelines, detects the security leaks attackers exploit, fixes them, and grades your GitLab CI/CD and GitHub Actions setup with a letter grade (A-E). It runs as one continuous loop: map, detect, fix, prove. It checks pipeline composition, container images, dangerous triggers and permissions, and branch protection against a policy file, with documented remediation for every issue found.

The open-source CLI scans a repository locally or in CI (GitLab CI/CD and GitHub Actions share one policy file and the same controls). The Plumber Platform continuously maps, audits, and remediates CI/CD security gaps across whole GitLab and GitHub organizations, for regulatory frameworks such as ISO 27001, NIS2, DORA, and SOC 2.

## Key pages

- [Plumber CLI (homepage)](https://getplumber.io/): Open-source CI/CD compliance CLI for GitLab and GitHub
- [GitHub repository](https://github.com/getplumber/plumber): Source code, releases, and issue tracker
- [Plumber Radar](https://getplumber.io/radar): Live compliance scan of the open-source GitLab ecosystem

## Documentation

- [Open Source CLI](https://getplumber.io/docs/cli): Plumber is an open-source CLI that audits GitLab CI/CD pipelines and GitHub Actions workflows for security. One policy file, shared controls, letter-grade reports.
- [GitHub](https://getplumber.io/docs/cli/github): Scan GitHub Actions workflows for security with the open-source Plumber CLI and GitHub Action: authentication, GitHub controls catalog, issues, SARIF and Code Scanning.
- [GitLab](https://getplumber.io/docs/cli/gitlab): Scan GitLab CI/CD pipelines for security with the open-source Plumber CLI: authentication, GitLab controls catalog, issues, configuration, and MR/badge integration.
- [Installation](https://getplumber.io/docs/cli/installation): Install the open-source Plumber CI/CD security CLI on macOS, Linux, or in CI via Homebrew, mise, prebuilt binary, Docker, or build from source.
- [CLI Reference](https://getplumber.io/docs/cli/reference): Provider-agnostic reference for the open-source Plumber CLI: the analyze command and flags, config commands, plumber explain, exit codes, PBOM / CycloneDX, and the output JSON shape.
- [Plumber Platform](https://getplumber.io/docs/getting-started): Get started with the Plumber Platform: connect GitLab or GitHub, audit your CI/CD pipelines against ISO 27001, NIS2, DORA, and SOC 2 requirements, and remediate drift continuously.
- [Installation Introduction](https://getplumber.io/docs/installation): This section describes how to setup your self-managed instance of Plumber.
- [Docker compose](https://getplumber.io/docs/installation/docker-compose): This page describes how to set up a self-managed instance of Plumber using Docker-compose.
- [Docker compose Local](https://getplumber.io/docs/installation/docker-compose-local): This page describes how to quickly setup a self-managed instance of Plumber for testing purposes using Docker-compose on your local computer.
- [Kubernetes Installation](https://getplumber.io/docs/installation/kubernetes): This page describes how to run a self-managed instance of Plumber on Kubernetes.
- [Podman](https://getplumber.io/docs/installation/podman): This page describes how to set up a self-managed instance of Plumber using podman.
- [Configuration Reference](https://getplumber.io/docs/installation/reference): This reference explains the global configuration options for Plumber. All configuration is managed through environment variables.
- [Troubleshooting](https://getplumber.io/docs/installation/troubleshooting): Common installation errors and how to solve them.
- [Controls](https://getplumber.io/docs/cli/controls): Browse Plumber's catalog of CI/CD security controls for GitLab pipelines and GitHub Actions workflows. Each control raises a documented issue with remediation guidance when violated.
- [Issues](https://getplumber.io/docs/cli/issues): Complete reference of all CI/CD security issues Plumber detects (ISSUE-XXXX), with severity, category, and step-by-step remediation guides for GitLab and GitHub.
- [CI/CD templates](https://getplumber.io/docs/use-plumber/register-templates): Learn how to register and manage CI/CD templates in Plumber.
- [GitLab Integration & Permissions](https://getplumber.io/docs/use-plumber/roles-permissions): Learn about roles and permissions in Plumber.

## Blog

- [Plumber CLI 0.4 Release - What's New](https://getplumber.io/blog/release-cli-04): Plumber CLI 0.4 adds nine new supply-chain and secret-exposure controls, makes the Plumber Score the build gate, and ships a CI-native score-push badge.
- [Plumber Score: A Security Standard for CI/CD Pipelines](https://getplumber.io/blog/plumber-score-cicd-security-standard): Plumber Score is a free, open-source A-E security grade for CI/CD pipelines: the unwatched stage AI is flooding with more code and more automated attacks. Publish yours, and check your dependencies' scores before trusting what they ship.
- [GitHub Actions: checkout v7 finally blocks pwn requests](https://getplumber.io/blog/github-actions-checkout-v7-pwn-request): checkout v7 refuses, by default, to fetch a fork's ref under pull_request_target, blocking the pwn request natively. The protection is backported to all supported majors on July 16, 2026, so floating tags inherit it automatically. Here is what changes, the allow-unsafe-pr-checkout exception to watch, and why almost every repository is affected.
- [Megalodon: Why OIDC Alone Won't Save You](https://getplumber.io/blog/oidc-wont-save-you-megalodon): OIDC removes static cloud credentials, but not the temporary credentials exposed while the runner executes. Megalodon is a reminder of the layers to stack around it: a strict trust policy, protected environments, least-privilege permissions, egress control, and workflow governance.
- [Plumber 1.4 Release - What's New](https://getplumber.io/blog/release-140): Introducing Plumber 1.4: bulk issue owner management with search, one-click auto-fix for merge request settings, and AWS Bedrock API key support.
- [Plumber CLI 0.3 Release - What's New](https://getplumber.io/blog/release-cli-03): Plumber CLI 0.3 adds GitHub Actions scanning, 14 GitHub controls, schema v2 configuration, and the same compliance workflow you already use on GitLab
- [The State of GitLab CI/CD Compliance 2026](https://getplumber.io/blog/state-of-gitlab-cicd-compliance-2026): What we found when we ran the open-source Plumber CLI against hundreds of public GitLab projects: the average pipeline grades a C, hardcoded jobs are almost universal, and 1 in 5 ships Docker-in-Docker.
- [Plumber CLI 0.2 Release - What's New](https://getplumber.io/blog/release-cli-02): Plumber CLI and GitLab component 0.2: new scoring model, new commands, catalog updates, and fixes
- [Plumber 1.3 Release - What's New](https://getplumber.io/blog/release-130): Introducing Plumber 1.3: a more resilient analysis process, sensitive data redaction in logs, and various improvements
- [Libération « Customer Story »](https://getplumber.io/blog/liberation-use-case): Libération: Bringing Clarity and Standardization to CI/CD Pipelines
- [Numspot « Customer Story »](https://getplumber.io/blog/numspot-use-case): Numspot: Building a Sovereign Cloud with Secure & Compliant CI/CD by Design
- [FDI Access « Customer Story »](https://getplumber.io/blog/fdi-use-case): FDI Access: Proving CI/CD Compliance for VIGIK+ and ISO 27001
- [6 Practical Steps to Harden Your GitHub Project's Supply Chain](https://getplumber.io/blog/harden-github-supply-chain): A step-by-step guide to adding SLSA provenance, OpenSSF Scorecard, SHA-pinned actions, least-privilege tokens, and more to your open-source project.
- [CI/CD Compliance Framework for Secure Pipelines](https://getplumber.io/blog/cicd-compliance-guidelines): Checklist and controls for audit-ready CI/CD compliance (ISO 27001, NIS2, DORA, CRA). Examples, evidence, drift detection, and remediation at scale.
- [Plumber 1.1 Release - What's New](https://getplumber.io/blog/release-110): Introducing Plumber 1.1: portfolio compliance details, and various improvements
- [Hardening Plumber's Supply Chain: SLSA 3, OpenSSF Scorecard, and Best Practices](https://getplumber.io/blog/openssf-and-salsa): How we added SLSA Level 3 provenance, OpenSSF Scorecard monitoring, and OpenSSF Best Practices to Plumber, and what each of these frameworks actually means for open-source security.
- [hackerbot-claw: CI/CD Pipelines Are the New Attack Surface](https://getplumber.io/blog/hackerbot-claw-cicd-governance): An AI bot compromised 5 of 7 major repos in one week via CI/CD misconfigurations. A call to govern, not patch. Why CI/CD compliance and pipeline governance must become standard.
- [Point Base « Customer Story »](https://getplumber.io/blog/pointbase-use-case): Point Base: Securing 1k+ Monthly Pipelines & Cutting CI/CD Overhead with Plumber
- [Your GitLab Pipelines Are Probably Non-Compliant. Here's How to Fix That in 5 Minutes.](https://getplumber.io/blog/hands-on-cli): A hands-on walkthrough of using Plumber to scan your GitLab CI/CD pipelines for compliance issues from install to continuous monitoring in under 5 minutes.
- [Plumber 1.0 Release - What's New](https://getplumber.io/blog/release-10): Introducing Plumber 1.0: a fresh identity, enhanced user activity tracking, and chart time range customization
- [Shai-Hulud 2.0: When npm install Becomes a CI/CD Attack](https://getplumber.io/blog/shai-hulud): Shai-Hulud 2.0 is a massive supply chain attack targeting CI/CD pipelines via malicious npm packages. Learn how to detect it and secure your GitLab & GitHub workflows immediately.
- [Could a Supply Chain Attack Like tj-actions/change-files Hit GitLab CI/CD Pipelines?](https://getplumber.io/blog/tj-actions-compromised): Critical security alert: Learn about the TJ Actions supply chain attack and how to protect your GitLab CI/CD pipelines from similar threats.
- [Plumber lauréat France 2030 – « Soutien aux PME et startups en cybersécurité »](https://getplumber.io/blog/france-2030-laureat): Plumber est lauréat du programme France 2030 – NCC-FR Cyber, opéré par Bpifrance et l'ANSSI, pour accélérer la sécurisation des pipelines CI/CD.
- [Top 5 Software Supply Chain Security Incidents](https://getplumber.io/blog/top-5-cybersecurity-incidents-in-cicd): Explore the top 5 software supply chain security incidents, including the SolarWinds attack and Codecov breach. Learn how these high-profile breaches highlight critical security vulnerabilities and best practices to protect your software supply chain

## Optional

- [Full documentation content](https://getplumber.io/llms-full.txt): All docs pages in one file
- [RSS feed](https://getplumber.io/rss.xml)
- [Contact](https://getplumber.io/contact)