A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.
Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.
Go supply chain security analysis – finds vulnerabilities, weak maintainers, typosquatting, and CI/CD risks. SBOM + enterprise PDF reports.
CLI Vulnify - Faz o scan em seus projetos buscando por vulnerabilidades.
Comprehensive guide for configuring Role-Based Access Control (RBAC) in Jenkins using the Role Strategy Plugin.
Offline Jenkins credential decryption tool for post-exploitation, red team operations, and CTFs. Decrypts credentials.xml using master.key and hudson.util.Secret without a running Jenkins instance. Supports legacy and modern encryption formats, with Docker and cross-platform support
Jenkins plugin for Xygeni - End to end software development and delivery security
Git-native secrets manager for teams and AI agents: age encryption, deterministic diffs, leak prevention, secure runtime injection. Dual-licensed MIT OR Apache-2.0.
Multi-gate open source supply chain trust validation pipeline with zero-day CVE expedited lane
Evidence-first prompt toolkit for AI-assisted supply chain security audits across npm, Composer, CI/CD, GitHub Actions, Next.js, Vercel, TanStack, containers, SaaS/OAuth and LGPD incident response.
Hands-on demo for the OSS Trust Framework — 6 scenarios including live CVE detection, IronWorm and Miasma behavioral pattern matching, and a full zero-day MFA quorum workflow. 131 passing tests · all offline.
Production-grade DevSecOps pipeline with automated vulnerability scanning
A production-style DevSecOps CI/CD pipeline demonstrating shift-left security with open-source tools. It performs SAST, secrets detection, dependency and container scanning, SBOM generation, and image signing before deploying to Kubernetes. The pipeline can run locally or via GitHub Actions and generates security reports for validation.
Production-grade DevSecOps project implementing a secure CI/CD pipeline with automated security scanning, container hardening, Kubernetes deployment, and cloud-native security practices.
Platform Security / DevSecOps reference: CVE scanning, CI/CD security gates, rollback automation, and audit trail for containerized production environments.
Advanced CI/CD supply-chain risk analyzer with dependency confusion detection, policy-as-code, SARIF, OSV intelligence, dashboard, and Docker deployment.
ᴄʏʙᴇʀ ꜱᴋʏ: ᴀɴ ᴀᴜᴛᴏɴᴏᴍᴏᴜꜱ, ᴀʟʟ-ɪɴ-ᴏɴᴇ ᴀꜱᴘᴍ & ᴄꜱᴘᴍ ᴘʟᴀᴛꜰᴏʀᴍ ᴜɴɪꜰʏɪɴɢ 15+ ꜱᴄᴀɴɴᴇʀꜱ (ꜱᴀꜱᴛ, ᴅᴀꜱᴛ, ꜱᴄᴀ, ɪᴀᴄ) ɪɴᴛᴏ ᴀ ꜱɪɴɢʟᴇ ᴏʀᴄʜᴇꜱᴛʀᴀᴛɪᴏɴ ʟᴏᴏᴘ. ꜰᴇᴀᴛᴜʀᴇꜱ ᴀɢᴇɴᴛɪᴄ ᴀɪ ᴘᴇɴᴇᴛʀᴀᴛɪᴏɴ ᴛᴇꜱᴛɪɴɢ ᴛᴏ ᴠᴀʟɪᴅᴀᴛᴇ ᴇxᴘʟᴏɪᴛꜱ, ꜰɪʟᴛᴇʀ ꜰᴀʟꜱᴇ ᴘᴏꜱɪᴛɪᴠᴇꜱ, ᴀɴᴅ ᴅᴇᴘʟᴏʏ ᴀᴜᴛᴏꜰɪx ʀᴇᴍᴇᴅɪᴀᴛɪᴏɴ ᴘᴀᴛᴄʜᴇꜱ ɴᴀᴛɪᴠᴇʟʏ ɪɴ ᴄɪ/ᴄᴅ ᴘɪᴘᴇʟɪɴᴇꜱ, ʀᴜɴᴛɪᴍᴇ ᴇɴᴠɪʀᴏɴᴍᴇɴᴛꜱ, ᴀɴᴅ ᴅᴇᴠᴇʟᴏᴘᴇʀ ᴡᴏʀᴋꜱᴛᴀᴛɪᴏɴꜱ.
Frozen same-owner source-to-artifact admission evidence: completed A-G rounds with detached verification; not publication, deployment, or independent review.
A rigorous laboratory for DevSecOps Engineering: bridging the gap between SOC analysis and infrastructure security. Documenting the transition through hands-on automation, container hardening, and production-grade security tooling.
Small Go CLI for publishing images to Harbor, triggering vulnerability scans, and exporting scan reports.
Add a description, image, and links to the ci-cd-security topic page so that developers can more easily learn about it.
To associate your repository with the ci-cd-security topic, visit your repo's landing page and select "manage topics."