DEV Community

Paras
Paras

Posted on Edited on AI-assisted

Your CI/CD Pipeline Is the Easiest Way Into Your Repo (And Nobody's Checking It)

#sideprojects #cicd #npm

Your CI/CD Pipeline Is the Easiest Way Into Your Repo (And Nobody's Checking It)

Your code gets reviewed. Your dependencies get scanned. But your CI/CD pipeline — the thing with access to your secrets, your deployments, and your production credentials — usually gets copy-pasted from a tutorial and never looked at again.

That's the gap plumber-linter was built for.

The problem hiding in plain sight

Here's a workflow file that looks completely normal. It's also a security incident waiting to happen:

name: CI
on: [push]

permissions: write-all

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: some-random-action/setup-node@main
      - run: |
          echo "Deploying..."
          curl -H "Authorization: Bearer AKIAIOSFODNN7EXAMPLE" https://api.example.com/deploy
Enter fullscreen mode Exit fullscreen mode

Three problems, zero warnings from your CI:

  1. permissions: write-all — the workflow can do everything: push code, read secrets, modify releases. A compromised step inherits all of it.
  2. An unpinned action (@main) — you're running whatever the maintainer pushes next, sight unseen. If that repo gets hijacked, so does your pipeline.
  3. A hardcoded secret in a run step — it now lives in your git history forever, and anyone with repo access can read it.

Most teams find these during an incident review. plumber-linter finds them before that.

What plumber-linter does

plumber-linter scans your CI/CD pipeline configs — GitHub Actions and GitLab CI — and flags:

  • Hardcoded secrets in workflow files
  • Overly broad permissions like write-all
  • Unpinned third-party actions that can change under you
  • Missing branch protections that let unreviewed code straight into main

And instead of cryptic rule IDs, it explains each finding in plain English — what the risk actually is, and how to fix it. So even if you're not a security person, you know exactly what to change and why.

Get started 

npm install plumber-linter
Enter fullscreen mode Exit fullscreen mode

Point it at your pipeline configs, fix what it flags, and your next deploy is already safer than your last one.

Why I built it

Pipeline security tools exist, but they're usually heavy, noisy, or written for security teams. I wanted something a regular developer could run in a minute and actually understand the output of. No 200-page report — just the real risks, explained like a person would explain them.

plumber-linter is at v1.1.0 now, and it's already got 800+ total downloads on npm. It's still early — if you run it on your repo and it catches something embarrassing, that's the whole point, and I'd genuinely love to hear about it.

Try it, break it, and tell me what it missed. Feedback welcome.

npm: https://www.npmjs.com/package/plumber-linter
Website: https://plumber-7dv.pages.dev/
GitHub: https://github.com/parasraju/plumber/

Built for GitHub Actions / GitLab CI. npm install plumber-linter

Top comments (0)