Skip to main content
Menu
On this page

Get your first Plumber Score

Plumber scans your CI/CD pipelines for security problems and grades them from A to E. Two steps to your first score:

1. Install

On macOS and Linux, with Homebrew:

Terminal window
brew tap getplumber/plumber
brew install plumber

No Homebrew? All install methods →

2. Get your first score

Authenticate with your provider:

  • GitHub (details):
    • already logged in with the gh CLI? Nothing to do, Plumber finds it automatically
    • otherwise set GH_TOKEN
  • GitLab: set GITLAB_TOKEN (details)

Then run from any repo that has GitHub Actions workflows or a .gitlab-ci.yml:

Terminal window
cd path/to/your/repo
plumber analyze

The report ends on your score. Above it, Plumber lists the attack paths it found (who can get into one of your jobs, and what they reach there) and the individual findings, each with one fix:

────────────────────
Score
────────────────────


 ██████╗   Plumber Score  34 / 100  █████████░░░░░░░░░░░░░░░░░░░
 ██╔══██╗  Status: FAILED (gate blocks at 100 pts)
 ██║  ██║
 ██║  ██║  Worst case: as anyone with write access to `main`, an attacker can execute code to write
 ██████╔╝  to security events and request an OIDC token (attack path 1: main)
 ╚═════╝   Best fix: move to a version without the advisory (action
           tj-actions/changed-files@2d756ea4c53f), +15 pts, 49 / 100 (D)

Run plumber explain -a 1 to see every finding behind attack path 1.

3. Go further

Gate your CI
Add Plumber to GitHub Actions or the GitLab CI component and block pipelines below your minimum score.
GitHub Actions →GitLab CI →
Understand your score
How attack paths, the A to E grade and the points work.
Plumber Score →
Tune the controls
One .plumber.yaml that extends the baseline with just what you change. See every control in the catalog.
Configuration →Issues catalog →
Monitor at scale
The self-hosted Plumber Platform: dashboards, issue lifecycle, team roles, always-on auditing.
Platform installation →

4. Community & support