Your CI/CD Pipeline Is the Easiest Way Into Your Repo (And Nobody's Checking It)

Your code gets reviewed. Your dependencies get scanned. But your CI/CD pipeline — the thing with access to your secrets , your deployments , and your production credentials — usually gets copy-pasted from a tutorial and never looked at again.

That's the gap plumber-linter was built for.

The problem hiding in plain sight

Here's a workflow file that looks completely normal. It's also a security incident waiting to happen :

name : CI on : [ push ]

permissions : write-all

jobs : build : runs-on : ubuntu-latest steps : - uses : actions/checkout@v4 - uses : some-random-action/setup-node@main - run : | echo "Deploying..." curl -H "Authorization : Bearer AKIAIOSFODNN7EXAMPLE" https://api.example.com/deploy

Enter fullscreen mode

Exit fullscreen mode

Three problems, zero warnings from your CI:

permissions: write-all — the workflow can do everything: push code, read secrets, modify releases.…