ci-cd-security

A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.

GPU-accelerated secret scanner for code, Git history, containers, cloud, browser assets, and CI. 923 detectors, live verification, CUDA, Metal, WGPU.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.

Open source attack-path engine for AWS and Kubernetes: correlates your scanners into one graph and blocks the pull request that opens a route to your data.

Defensive static analysis and detection engineering for the 2026 Shai-Hulud npm supply-chain campaign: Sigma/YARA rules, IOCs, ATT&CK mapping, and defender guidance.

Language-agnostic software supply-chain security scanner covering 28 ecosystems. Detects malicious packages, suspicious code, install-time threats, secrets and AI-agent security risks before execution

Multi-gate open source supply chain trust validation pipeline with zero-day CVE expedited lane

Comprehensive guide for configuring Role-Based Access Control (RBAC) in Jenkins using the Role Strategy Plugin.

Offline Jenkins credential decryption tool for post-exploitation, red team operations, and CTFs. Decrypts credentials.xml using master.key and hudson.util.Secret without a running Jenkins instance. Supports legacy and modern encryption formats, with Docker and cross-platform support

Go supply chain security analysis – finds vulnerabilities, weak maintainers, typosquatting, and CI/CD risks. SBOM + enterprise PDF reports.

Jenkins plugin for Xygeni - End to end software development and delivery security

Git-native secrets manager for teams and AI agents: age encryption, deterministic diffs, leak prevention, secure runtime injection. Dual-licensed MIT OR Apache-2.0.

Cryptographic proof of how an artifact was built, not just that it wasn't tampered with. Hands-on lab comparing Cosign signing vs SLSA Level 3 provenance using GitHub Actions, slsa-github-generator and slsa-verifier - including a forged-provenance attack demo.

Curated list of tools, research and guidance for securing and reviewing GitHub Actions workflows

Production-grade DevSecOps pipeline with automated vulnerability scanning

Interactive Terraform and OpenTofu plan visualizer, blast-radius inspector, pre-flight security linter, and PR summary reporter.

Talk materials for "Your Agent Escaped Without Escaping the Sandbox" (Zenity AI Agent Security Summit, NYC, Oct 2026): deck, script, paper, scripted-agent lab.

A rigorous laboratory for DevSecOps Engineering: bridging the gap between SOC analysis and infrastructure security. Documenting the transition through hands-on automation, container hardening, and production-grade security tooling.

Static security auditor for GitHub Actions workflows: script injection, pwn requests, unpinned actions, excessive permissions. SARIF output.

Evidence-first prompt toolkit for AI-assisted supply chain security audits across npm, Composer, CI/CD, GitHub Actions, Next.js, Vercel, TanStack, containers, SaaS/OAuth and LGPD incident response.