{"object":"cicd_rules","ruleset_version":"2026.07.24","updated":"2026-07-24","object_scanned":"CI/CD pipeline config (GitHub Actions / GitLab CI / CircleCI) — pipeline-security posture, not cloud resources or app code","rules_total":25,"attack_classes":25,"rules":[{"id":"gha.unpinned_uses","provider":"github-actions","dimension":"supply_chain","severity":"high","kind":"per_object"},{"id":"gha.unpinned_image","provider":"github-actions","dimension":"supply_chain","severity":"medium","kind":"per_object"},{"id":"gha.template_injection","provider":"github-actions","dimension":"injection","severity":"critical","kind":"per_object"},{"id":"gha.github_env_injection","provider":"github-actions","dimension":"injection","severity":"high","kind":"per_object"},{"id":"gha.insecure_commands","provider":"github-actions","dimension":"injection","severity":"high","kind":"per_object"},{"id":"gha.secret_in_log","provider":"github-actions","dimension":"secrets_exposure","severity":"high","kind":"per_object"},{"id":"gha.secret_in_command","provider":"github-actions","dimension":"secrets_exposure","severity":"medium","kind":"per_object"},{"id":"gha.excessive_permissions_workflow","provider":"github-actions","dimension":"permissions","severity":"high","kind":"per_object"},{"id":"gha.undocumented_permissions","provider":"github-actions","dimension":"permissions","severity":"medium","kind":"per_object"},{"id":"gha.excessive_permissions_job","provider":"github-actions","dimension":"permissions","severity":"medium","kind":"per_object"},{"id":"gha.persist_credentials","provider":"github-actions","dimension":"hygiene","severity":"medium","kind":"per_object"},{"id":"gha.self_hosted_runner","provider":"github-actions","dimension":"runner_security","severity":"medium","kind":"per_object"},{"id":"gha.bot_condition","provider":"github-actions","dimension":"hygiene","severity":"low","kind":"per_object"},{"id":"generic.curl_pipe_shell","provider":"generic","dimension":"supply_chain","severity":"high","kind":"per_object"},{"id":"generic.adhoc_install","provider":"generic","dimension":"supply_chain","severity":"low","kind":"per_object"},{"id":"gitlab.unpinned_image","provider":"gitlab-ci","dimension":"supply_chain","severity":"medium","kind":"per_object"},{"id":"gitlab.script_injection","provider":"gitlab-ci","dimension":"injection","severity":"high","kind":"per_object"},{"id":"gitlab.debug_trace","provider":"gitlab-ci","dimension":"secrets_exposure","severity":"high","kind":"per_object"},{"id":"gitlab.unpinned_include","provider":"gitlab-ci","dimension":"supply_chain","severity":"medium","kind":"per_object"},{"id":"circleci.unpinned_orb","provider":"circleci","dimension":"supply_chain","severity":"high","kind":"per_object"},{"id":"circleci.unpinned_image","provider":"circleci","dimension":"supply_chain","severity":"medium","kind":"per_object"},{"id":"gha.dangerous_trigger_checkout","provider":"github-actions","dimension":"triggers","severity":"critical","kind":"cross_object"},{"id":"gha.privileged_trigger","provider":"github-actions","dimension":"triggers","severity":"high","kind":"cross_object"},{"id":"gha.secrets_inherit","provider":"github-actions","dimension":"secrets_exposure","severity":"high","kind":"cross_object"},{"id":"gha.cache_poisoning","provider":"github-actions","dimension":"integrity","severity":"medium","kind":"cross_object"}],"dimensions":["supply_chain","injection","triggers","permissions","secrets_exposure","runner_security","integrity","hygiene"],"counts_by_dimension":{"supply_chain":8,"injection":4,"triggers":2,"permissions":3,"secrets_exposure":4,"runner_security":1,"integrity":1,"hygiene":2},"counts_by_provider":{"circleci":2,"generic":2,"github-actions":17,"gitlab-ci":4},"counts_by_severity":{"critical":2,"high":11,"medium":10,"low":2},"ci_systems":["github-actions","gitlab-ci","circleci","generic"],"verdicts":["pass","caution","block"],"severity_weights":{"critical":40,"high":25,"medium":12,"low":5,"info":1},"block_score_threshold":40,"limits":{"max_bytes":262144,"max_objects":4000,"max_findings":500},"provenance":"Curated by us from PUBLIC CI/CD security taxonomies (the OWASP Top 10 CI/CD Security Risks CICD-SEC-1..10, the zizmor GitHub-Actions audit taxonomy, and GitHub's own 'Security hardening for GitHub Actions' guide). Rule LOGIC (facts like 'an action pinned to a mutable tag is a supply-chain risk') is not copyrightable; NO third-party rule code or dataset is copied — every reason/fix string is authored here.","disclaimer":"Automated security indicators, NOT a guarantee. A pass/clean verdict is not an endorsement and a block is not proof of exploitability — always review the pipeline configuration and your threat model before merging CI/CD changes.","note":"Freshness = a data update of the rule registry (no live daemon). The paid /ci/scan and /ci/inspect routes evaluate against this ruleset. Boundary: cicdscan flags PIPELINE security (supply-chain pinning, injection, triggers, token permissions) — not cloud posture (/iac/scan), app CWEs (/code/scan), secret VALUES (/secret/scan) or MCP manifests (/mcp/scan)."}