Prevent merging of malicious code in pull requests
High-performance open-source security scanner combining SAST, SCA, Secret Detection, and IaC analysis, built for developers and CI/CD pipelines, using AI for recommendation!
Focused malicious code detection ruleset, with a high protection-to-noise ratio
Repository containing source code of MixewayFlow service that is Swiss army knife for DevSecOps Teams
GitHub Actions security scanner: pin actions to SHAs, detect script injection, audit permissions. Fix supply chain vulnerabilities.
Offensive GitHub Actions attack surface analyzer : scan any repo for CI/CD vulnerabilities, pwn requests, supply chain risks, and secret leaks. Powered by 20 detection rules with CVSS scoring and OWASP CI/CD Top 10 mapping.
Open-source platform for machine identity security — discover, map, and risk-score IAM roles, OIDC federations, and CI/CD tokens across AWS
A comprehensive security design review checklist for hardening Jenkins, GitHub Actions, AWS, and Azure pipelines. Audit your software supply chain before production.
GRIMSEC — 12 AI-Powered DevSecOps Agents. Analyze, audit, validate, and remediate vulnerabilities in any GitHub repo. 89-96% noise reduction.
JenkinsBreaker: Offensive CI/CD security research framework focused on Jenkins exploitation, CVE chaining, and pipeline compromise scenarios.
Enterprise application security playbook covering attacker-driven testing, vulnerability management, and security automation across the SDLC.
Five review-gate skills for Claude Code that catch AI-generated code failures before they ship — code quality (15 LLM failure modes), tests, docs, security (OWASP Top 10:2025, CWE Top 25, LLM Top 10), and CI/CD–container–IaC hardening. Self-verifying via CI.
🐦⬛ Static scanner for fork-triggerable AI coding agents in CI. Detects prompt-injection-to-RCE exposure in GitHub Actions and GitLab CI.
eBPF runtime security for CI/CD and Linux hosts: egress control, process/file/network monitoring, and audit-mode policy generation. Ships as a CLI and a GitHub Action.
🛡️ A curated list of awesome DevSecOps tools, best practices, and resources for securing CI/CD pipelines. Covers SCA, SAST, DAST, IaC, and Container Security.
🛡️ A modern DevSecOps CI/CD pipeline dashboard and security portal. Monitors codebases using multi-layered scanners (GitLeaks, Trivy, Semgrep, Bandit) and generates isolated HTML vulnerability reports. Built with React, Vite, Express, and MongoDB.
Security Engineering reference: taint analysis benchmark comparing Pysa, CodeQL & Semgrep on a controlled Django app (16 OWASP Top 10 cases). Includes CI/CD integration with SARIF, ground truth validation, and enterprise scaling patterns.
Collection of custom GHA and reusable workflows.
Full VAPT writeup of OWASP CICD-Goat — 9 CTFd flags captured, 4 critical + 5 high findings (incl. CVE-2024-23897) mapped to the OWASP Top 10 CI/CD Security Risks, with PoCs, remediation, and interview-ready summaries.
Top CI CD Security Platform 🌟 Star if you like it! 🌟
To associate your repository with the cicd-security topic, visit your repo's landing page and select "manage topics."