Plumber - CI/CD security for GitLab and GitHub

Plumber is an open-source CI/CD security scanner built specifically for GitLab and GitHub. It doesn't just check your code — it looks at your pipelines themselves. Plumber maps every pipeline across your repositories, then surfaces exposed secrets, misconfigured jobs, and risky actions that attackers love to exploit. The tool then assigns a single letter grade — the Plumber Score — from A (strong) to E (critical issues), making it dead simple to understand and communicate your pipeline security posture to teammates or auditors.

You can start with the CLI, running scans locally or inside your CI as a GitHub Action or GitLab CI component. The open-source CLI is free and scans one pipeline at a time. When you need to monitor your whole organization, the Plumber platform provides a dashboard with drift alerts, compliance reports, and an AI agent that can automatically apply fixes (with a full audit trail). The enterprise plan adds unlimited projects, AI-driven suggestions, and dedicated support. The platform itself is free for up to 10 projects.

This tool is for DevOps engineers who want to catch pipeline misconfigurations before they become breaches, security teams that need to prove compliance continuously, and anyone managing multiple repos on GitLab or GitHub who wants an automated way to stay secure. If you're tired of manual security reviews and want something that plugs straight into your existing workflow, Plumber is worth a look.