Show HN: Plumber, open-source CLI that scores your CI/CD pipeline security (A–E)
Plumber is an open-source CLI tool that analyzes CI/CD pipeline configurations and assigns a security rating from A to E, helping developers identify and fix vulnerabilities in their deployment workflows.
Background
- Plumber is a new open-source CLI tool (not the R-based "plumber" API package) that analyzes CI/CD pipeline configs and grades them A–E for security posture.
- The people behind it have not made a major name for themselves yet; this is a "Show HN" launch on Hacker News, meaning the project is debuting for community feedback.
- CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Jenkins) automate building, testing, and deploying code. Misconfigurations can create security holes — e.g., leaking credentials, granting excessive permissions, or allowing attackers to inject malicious code.
- There are existing tools like Checkov or tfsec for IaC security, but Plumber focuses specifically on the CI/CD *pipeline configuration* itself, not the infrastructure it deploys.
- Scoring follows a simple familiar letter-grade scheme (A through F, with A being best). This is aimed at developers and DevOps engineers who want a quick, actionable signal without deep security expertise.