zanadir and the OWASP Top 10 CI/CD Security Risks
The OWASP Top 10 CI/CD Security Risks lists what attackers abuse in build pipelines. zanadir is an open-source CI/CD security tool that reads a repository's pipeline and checks that the controls for these risks are there, and that they can actually fail the build.
zanadir does not find the attacks itself. For each risk below, it checks that a tool which does runs in CI, and grades whether that tool can stop a merge: enforcing, partial, advisory or unknown. Four of the ten are platform and organisation settings that a repository's files cannot show, and zanadir says so rather than guessing.
| Risk | What zanadir checks |
|---|---|
| CICD-SEC-1 Insufficient Flow Control Mechanisms | Covered. Every security check is graded on whether it runs on pull requests or only after the push. With --required-checks, a check counts only when branch protection or a ruleset requires it to merge. |
| CICD-SEC-2 Inadequate Identity and Access Management | Not covered. Identities and access live in the organisation's settings, not in the repository. |
| CICD-SEC-3 Dependency Chain Abuse | Covered (SCA). A dependency scanner such as Grype, Trivy, OSV-Scanner, govulncheck, pip-audit or npm audit runs and can fail, not only a Dependabot or Renovate configuration. |
| CICD-SEC-4 Poisoned Pipeline Execution | Covered (Workflow Security). A workflow scanner such as zizmor, poutine, actionlint or glsec, which finds script injection and untrusted checkouts, runs and can fail. |
| CICD-SEC-5 Insufficient Pipeline-Based Access Controls | Covered (Workflow Security). The same scanners flag workflow tokens with more permissions than a job needs. |
| CICD-SEC-6 Insufficient Credential Hygiene | Covered (Secrets Detection). A secret scanner such as Gitleaks, TruffleHog or ggshield runs and can fail. |
| CICD-SEC-7 Insecure System Configuration | Not covered. Runner and CI server configuration is outside the repository. |
| CICD-SEC-8 Ungoverned Usage of 3rd Party Services | Not covered. Installed apps and integrations live in the organisation's settings. Workflow scanners do flag unpinned third-party actions, one slice of this risk. |
| CICD-SEC-9 Improper Artifact Integrity Validation | Covered (Supply Chain). An SBOM (Syft, CycloneDX), a signature (Cosign) or provenance (SLSA, GitHub attestations, in-toto) is produced, graded on the workflow that ships the release. |
| CICD-SEC-10 Insufficient Logging and Visibility | Not covered. Audit logs are a platform setting. |
Try it
Scan a public GitHub repository in your browser, with nothing to install, or run it on your own checkout:
Scan a repository in your browserzanadir scan --dir . --required-checks
zanadir fix --dir .zanadir fix prints the CI configuration that closes the gaps it found.