Source Control & CI/CD Hygiene Check – Build Pipeline Takeover Risks

If a stranger's pull request can run with your secrets, they do not need to hack you. They just need to open one.

The Source Control & CI/CD Hygiene Check reads the build-pipeline files in a repository you own — GitHub Actions, GitLab CI, Azure Pipelines, Jenkins, CircleCI — for the patterns that let someone else run code in your build: workflows that execute untrusted pull requests with secrets available, steps pinned to a moving tag, secrets passed into shell commands, and curl-piped-to-shell installs. Then it checks the repository itself: committed credential files, tokens embedded in remote URLs, and whether commits are signed.

What it checks

• Build-pipeline files for GitHub Actions, GitLab CI, Azure Pipelines, Jenkins and CircleCI, read from your folder
• Dangerous trigger and permission combinations — above all, running a stranger's pull request with your secrets
• Build steps pinned to a moving tag instead of a fixed version, and secrets handed to untrusted steps
• Shell installs that download and run whatever a URL serves that day
• Local git hygiene: committed credential files, remote URLs with embedded tokens, commit signing
• Optionally, the public information about your repository on GitHub — and it says plainly what it cannot verify without an access token

What you get

• A written PDF report emailed back to you, typically within one business day.
• Every finding rated Critical / High / Medium / Low, with the workflow file and the line identified.
• An executive summary you can hand to a client, an insurer or an acquirer asking how your software is built.
• Fix-first remediation: which workflow to change today, and which settings only you can confirm in your hosting provider's console.
• A "what was checked" appendix that states the limits of the scan honestly.
• Reporting built to CompTIA Security+ and PenTest+ practice standards.

Who it's for

Solo developers, small development shops, and any business that ships software from a hosted repository and has never had its pipeline looked at. It never asks for an access token — what it cannot see without one, it tells you.

Requirements

• Windows 10 or Windows 11
• No administrator rights needed
• A local checkout of a repository you own or are authorised to scan
• An internet connection only if you opt in to the public GitHub lookup
• About 3 minutes

What this is not

QuickScan is detection and advisory only. It reads pipeline and git files; it never uploads your source code, never runs a workflow, never uses or requests an access token, and changes nothing in your repository. Branch-protection settings live in your hosting provider's console, so the report lists them as unverified rather than guessing. It is not a certification, an audit or an attestation.

One-time purchase. No subscription, no auto-renewal. Your report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.