Getting Started
Get your first Plumber Score
Plumber scans your CI/CD pipelines for security problems and grades them from A to E. Two steps to your first score.
2 min
from install to score
A-E
one grade per pipeline
GitHub + GitLab
same checks, same score
Install
On macOS and Linux, with Homebrew:
brew tap getplumber/plumberbrew install plumberNo Homebrew? All install methods
Get your first score
Authenticate with your provider:
GH_TOKEN- Already logged in with the
ghCLI? Nothing to do, Plumber finds it automatically. - Otherwise set
GH_TOKEN.
GITLAB_TOKEN- Set
GITLAB_TOKEN.
Then run from any repo that has GitHub Actions workflows or a .gitlab-ci.yml:
cd path/to/your/repoplumber analyzeThe report ends on your score. Above it, Plumber lists the attack paths it found (who can get into one of your jobs, and what they reach there) and the individual findings, each with one fix:
Worst case: as anyone with write access to `main`, an attacker can execute code to write to security events and request an OIDC token (attack path 1: main)
Best fix: move to a version without the advisory (action tj-actions/changed-files@2d756ea4c53f), +15 pts, 49 / 100 (D)
Next step
Run plumber explain -a 1 to see every finding behind attack path 1.
Go further
Add Plumber to GitHub Actions or the GitLab CI component and block pipelines below your minimum score.
How attack paths, the A to E grade and the points work.
One .plumber.yaml that extends the baseline with just what you change. See every control in the catalog.
The self-hosted Plumber Platform: dashboards, issue lifecycle, team roles, always-on auditing.