CLI
pipefort — scan a local directory or a remote GitHub repo from the command line. Supports --fix for in-place YAML rewrites.Web dashboard
Multi-tenant web dashboard. Connect a GitHub account or org and get continuous OWASP posture across every repo’s workflows.
What it detects
Pipefort runs dozens of checks across GitHub Actions and GitLab CI workflows, online supply-chain audits, and repository settings — covering all ten OWASP Top 10 CI/CD risk categories, SLSA build levels, and workflow best practices. See the rules reference for the full list. A few of the most common:
Filter to OWASP-only with
--ruleset owasp (CLI) or the ruleset selector in the dashboard.
How it works
The scanner parses each workflow file and runs deterministic checks against it — no LLMs, no external services. Detection logic is shared between the CLI and the web app, so both always produce identical findings for the same file. The web app pulls workflow YAML over the GitHub API and scans it directly — there’s nogit clone, and your source code is never copied onto Pipefort’s servers.
Next steps
Quickstart
Run your first scan in 60 seconds.
How it works
One engine behind the CLI and the dashboard, and what Pipefort asks GitHub for.