Scanners
Scan CI/CD pipelines for supply-chain weaknesses
Black Hat Arsenal CI/CD pipeline scanner for GitHub, GitLab, and Azure DevOps, offline or API driven.
overview
What trajan does
trajan reads pipeline definitions and reports the security weaknesses in how they are written: workflows triggered by untrusted events, secrets exposed to code a contributor controls, actions pinned to a moving tag, permissions wider than the job needs. Those are configuration facts, so they are visible without running the pipeline and without any access to the runner.
The node takes two paths to that input. Point --path at a folder of workflow YAML for a fully offline scan, which is the mode the Library workflow ships because it needs no token and no network. Set --target with --platform and a vault token when you want trajan to pull the configuration from GitHub, GitLab, or Azure DevOps itself and cover an org rather than one checkout.
Output is findings.jsonl plus the raw trajan-out artifacts, so a workflow can correlate it with other supply-chain evidence. The CICD Attack Surface Scanner runs it beside a coding-agent CI scan and merges both into one report you can schedule against your own .github/workflows tree.
use cases
Where trajan fits
Scan a workflow tree with no credentials
Mount .github/workflows on the path port for an offline pass that reads every pipeline definition in the checkout and needs no token.
Cover a whole org through the API
Set target to an owner or org with a vault token so trajan pulls pipeline configuration for every repository rather than the one you cloned.
Find pipelines that trust untrusted input
Surface the triggers and permission grants that let a fork or a comment reach a job with secrets attached, which is where pipeline compromise usually starts.
Gate a supply-chain report on a schedule
Run it in the CICD Attack Surface Scanner beside a coding-agent scan so pipeline findings and agent-policy findings correlate into one artifact.
reference
trajan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| path | FOLDER | --path | Offline local workflows path (BYO YAML tree, preferred) |
| target | STRING | --target | API locator (GitHub owner/repo or org, GitLab path, ADO org/project). Needs token. |
| platform | STRING | --platform | github | gitlab | ado (default github) |
| token | STRING | --token | Vault secret chip, set to BH_GITHUB_TOKEN. An offline path scan ignores it when unset. |
Showing key inputs. trajan exposes 4 inputs in total.
example
Run trajan
# offline: scan a checked-out workflow treetrajan --path ./.github/workflows # API: scan an org (token comes from the vault chip)trajan --platform github --target example-org{ "tool": "trajan", "platform": "github", "repo": "example-org/example-repo", "workflow": ".github/workflows/build.yml", "issue": "pull_request_target with checkout of untrusted ref", "severity": "high", "remediation": "Split the trusted and untrusted jobs, or drop the secret from this job"}guidance
Choosing trajan
Reach for trajan when the target is the pipeline definition itself across GitHub, GitLab, or Azure DevOps. Use semgrep-scan when you want custom rules over application source, and use gitleaks or trufflehog when the question is committed secrets rather than pipeline structure.
semgrep-scan
Pattern rules over source, including YAML. Better for bespoke policy; trajan already knows the CI platform semantics.
gitleaks
Finds secrets committed to a repository. Complementary: trajan reports the pipeline that would expose one, gitleaks finds the one already there.
trufflehog
Secret discovery with verification across many sources. Same complement, different reach; neither models pipeline permissions.
workflows
Workflows using trajan
faq
trajan questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run trajan yourself
A workflow YAML tree or an API target feeds trajan, which writes pipeline findings for a correlate or report node.
Facts on this page come from the live Trickest tool library.