loading
Loading content
loading
Scanners
Black Hat Arsenal CI/CD pipeline scanner for GitHub, GitLab, and Azure DevOps, offline or API driven.
overview
trajan reads pipeline definitions and reports the security weaknesses in how they are written: workflows triggered by untrusted events, secrets exposed to code a contributor controls, actions pinned to a moving tag, permissions wider than the job needs. Those are configuration facts, so they are visible without running the pipeline and without any access to the runner.
The node takes two paths to that input. Point --path at a folder of workflow YAML for a fully offline scan, which is the mode the Library workflow ships because it needs no token and no network. Set --target with --platform and a vault token when you want trajan to pull the configuration from GitHub, GitLab, or Azure DevOps itself and cover an org rather than one checkout.
Output is findings.jsonl plus the raw trajan-out artifacts, so a workflow can correlate it with other supply-chain evidence. The CICD Attack Surface Scanner runs it beside a coding-agent CI scan and merges both into one report you can schedule against your own .github/workflows tree.
use cases
Mount .github/workflows on the path port for an offline pass that reads every pipeline definition in the checkout and needs no token.
Set target to an owner or org with a vault token so trajan pulls pipeline configuration for every repository rather than the one you cloned.
Surface the triggers and permission grants that let a fork or a comment reach a job with secrets attached, which is where pipeline compromise usually starts.
Run it in the CICD Attack Surface Scanner beside a coding-agent scan so pipeline findings and agent-policy findings correlate into one artifact.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| path | FOLDER | --path | Offline local workflows path (BYO YAML tree, preferred) |
| target | STRING | --target | API locator (GitHub owner/repo or org, GitLab path, ADO org/project). Needs token. |
| platform | STRING | --platform | github | gitlab | ado (default github) |
| token | STRING | --token | Vault secret chip, set to BH_GITHUB_TOKEN. An offline path scan ignores it when unset. |
Showing key inputs. trajan exposes 4 inputs in total.
example
# offline: scan a checked-out workflow treetrajan --path ./.github/workflows # API: scan an org (token comes from the vault chip)trajan --platform github --target example-org{ "tool": "trajan", "platform": "github", "repo": "example-org/example-repo", "workflow": ".github/workflows/build.yml", "issue": "pull_request_target with checkout of untrusted ref", "severity": "high", "remediation": "Split the trusted and untrusted jobs, or drop the secret from this job"}guidance
Reach for trajan when the target is the pipeline definition itself across GitHub, GitLab, or Azure DevOps. Use semgrep-scan when you want custom rules over application source, and use gitleaks or trufflehog when the question is committed secrets rather than pipeline structure.
Pattern rules over source, including YAML. Better for bespoke policy; trajan already knows the CI platform semantics.
Finds secrets committed to a repository. Complementary: trajan reports the pipeline that would expose one, gitleaks finds the one already there.
Secret discovery with verification across many sources. Same complement, different reach; neither models pipeline permissions.
workflows
faq
related
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
Reflection triage for parameter URLs during recon.
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
CMS detection and version fingerprinting.
Signature-driven web application scanner.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
A workflow YAML tree or an API target feeds trajan, which writes pipeline findings for a correlate or report node.
Facts on this page come from the live Trickest tool library.