4 findings. 4 GHSAs. 4 CVEs requested. Same-day disclosure. v0.8.2 ships with the fixes. v0.8.3 wires the four PoCs in as permanent CI regression gates so the bugs cannot silently return. Total elapsed: ~48 hours. Total cost: $0.30 in cloud spend.

ciguard, briefly

ciguard is a static security auditor for CI/CD pipelines — GitLab CI, GitHub Actions, and Jenkins, plus cross-platform SCA. It ships as pip install ciguard , a multi-arch Docker image, and an MCP server you can plug into Claude Desktop, Claude Code, or Cursor. 44 deterministic rules across three platforms, 17 built-in policies, four output formats including SARIF 2.1.0 with native baseline diffing.

It went public on PyPI on 2026-04-25. The next day, it pentested itself.

This is the writeup of that engagement.

Why self-pentest a security tool?

Two reasons, neither of them tactical:

One — the credibility cost of finding a bug in a security tool is multiplicative. Users assume a security tool is itself secure.…