Harden-CI: Protect your CI/CD

Your pipeline knows secrets, but who checks the pipe?

CI/CD runs a code haveing access to keys / tokens and ither rights to publish, that is why Supply-chain attacks to dependencies / components are more often start not from application, but from a build process

At the same time, the pipeline lives without any oversight. It may have tests, but they might not block new vulnerabilities or new code. Actions and images are linked to the latest tag. Images are not signed. Transitive dependencies have not been reviewed by anybody. And the main git branch is not protected from force pushes. Each of these items is small and easy to fix, but each of them is an open door for bad guys

Harden-CI: turn your AI agent to security auditor

Harden-CI - it is only a file for your AI agent: Claude Code, Codex, Antigravity, or something like this. You should not install anything - just open your agent in your repository using a terminal or desktop/mobile app and send it the link to the website https://harden-ci.secmy.app/

There are a few steps:

• Audit - The agent does 16 checks and no any changes: no files, branches, or project settings
• Report - You will receive a matrix of statuses (✅ ⚠️ ❌ ❓) and a list of findings by priority, from critical to low. Each finding is supported by a fact, and where something couldn’t be verified, the agent honestly uses a question❓ mark and suggests how you can find out (for example - manually on github / gitlab websites)
• Your choice - You should decide what should be fixed. Your agent should not change anything without your decision
• Fixing stage - The agent makes changes in a separate branch and opens a pull request or merge request for each one. You just need to review and merge changes, whether you’re using GitHub, GitLab, or other solution

How it looks: just send the link to your agent when you are in the project, and you will remember. See the picture below. Actually, that’s all. just make a decision and be happy

What exactly does Harden-CI

During 16 steps, the add-on covers the whole chain from code to production

• the code, inventory of applications, threat modeling, unit testing, static application security testing (known as SAST)
• dependencies - vulnerabilities, including transitive dependencies; new versions should be at least seven days old.
• secret scanning via betterleaks. Of course, values should not be highlighted in reports as is
• pipeline security - pinning actions and images to SHA instead of the latest tag (or yet another tag)
• containers - should be scanned for vulnerabilities too, by Trivy, for example. Check the signature with Cosign and add an SBOM file
• infrastructure - I mean two surfaces here: infrastructure as code and your platform’s security settings, like GitLab or GitHub. For example, main branch protection and git commits signatures
• API and production - API specifications like Swagger files and dynamic application security testing (known as DAST). Check whether debug features could have been built into Docker images or yet another result
• Hygiene - licenses , account protection and the SECURITY.md file

Why this project is?

It’s just because right now everyone has their own AI agent / AI assistant. It’s too easy to create a secure CI/CD. You should not be too lazy to create a really secure pipeline. And that is why I have created this page, just to help myself, my friends, and maybe you too. And of course, it’s possible to ignore some rules just because some of them are not applicable to your environment. That’s okay. You should not be absolutely aligned with the rules in this project. Even have 2-3 additional steps is better than nothing. if you absolutely disagree with some items/rules – the project is on GitHub. You may clone it, create your own list, or suggest changes

Get started in one minute

Harden-CI – the project is useful for solo developers or even for teams. If you do not have enough time for a manual audit and for thinking about best practices, let’s use this project. You should not need to create an additional subscription or service, or give access to a third party to set up and secure your pipeline. All changes happen on your machine, according to clear open rules and your review. It’s just a text description, and you can read each stage and rule yourself

1. Run AI-agent in your repo (claude code / antigravity / codex etc…)
2. Just past the link https://harden-ci.secmy.app/
3. Read the result!

Do you have idea? Suggest it here https://github.com/SecH0us3/harden-ci