CI/CD Pipeline Security

Pick the first of two products.

Open a name for its full profile

GitLab Ultimate
Scored
GitLab · Freemium · 1 capabilities in this domain · 3.95 / 5
Select
GitHub Actions
Capabilities only
GitHub · Freemium · 5 capabilities in this domain
Select
zizmor
Capabilities only
zizmor Project · Open Source · 4 capabilities in this domain
Select
StepSecurity Secure Repo and Maintained Actions
Capabilities only
StepSecurity · Freemium · 3 capabilities in this domain
Select
Chainguard Actions
Capabilities only
Chainguard · Commercial · 2 capabilities in this domain
Select
StepSecurity Harden-Runner
Capabilities only
StepSecurity · Freemium · 2 capabilities in this domain
Select
actionlint
Capabilities only
actionlint Project · Open Source · 2 capabilities in this domain
Select
poutine
Capabilities only
BoostSecurity · Open Source · 2 capabilities in this domain
Select
Gato-X
Capabilities only
Gato-X Project · Open Source · 1 capabilities in this domain
Select
Legit Security
Capabilities only
Legit Security · Commercial · 1 capabilities in this domain
Select

In CI/CD Pipeline Security

StepSecurity Secure Repo and Maintained Actions

StepSecurity · CI/CD Pipeline Security

FreemiumCompany

Secure Repo hardens workflows automatically; StepSecurity maintained actions provide reviewed, secure replacements for popular third-party actions.

What it does3 capabilities · 3 at full coverage

3 of 3 at full coverage.

Curated Hardened Action CatalogFullCICD · level 4 · 3 providers
Pipeline Permission MinimizationFullCICD · level 2 · 4 providers
Third-Party Action & Plugin Pinning EnforcementFullCICD · level 2 · 6 providers

What it proves11 controls across 7 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CI/CD Top 103 / 10CICD-SEC-3 CICD-SEC-5 CICD-SEC-8
SP 800-204D2 / 11204D-CI-BUILD 204D-ZT-LEASTPRIV
Scorecard2 / 20Pinned-Dependencies Token-Permissions
CIS Benchmarks1 / 6CIS Software Supply Chain Security Guide
CNAS Top 101 / 10CNAS-4
CSF 2.01 / 106PR.AA-05
SSDF 1.11 / 42PO.3.2

What it stops4 techniques · 2 risks

4 techniques countered, 4 of them common

CI Runner Secret ExfiltrationCommon
Compromise Software Supply ChainT1195.002Common
Mutable Tag Hijack of CI Actions and ImagesCommon
Steal Application Access TokenT1528Common

2 risks reduced

Attacker executes code in the CI/CD pipelineCritical
Pipeline secrets exfiltrated from runners or logsHigh

Where it runs1 phase · 2 ways to deploy

Capabilities per lifecycle phase

Build3

How it is delivered

SaaSSource control app

What it unlocks2 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 2

SHA-pin actions and set least-privilege tokensLow effort

Level 5

CuratedHigh effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsOpen core or freemium · free tier

LicensingOpen core or freemium

Priced perfree tier plus paid tiers

BillingSubscription

Scales withFeature tier, users or usage beyond the free tier

Total cost

Start free; enterprise needs such as SSO, audit logs and policy often require the paid tier.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at1 sibling

Same family

StepSecurity Harden-RunnerFreemium

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13