Harden-CI
A security audit tool for CI/CD pipelines, delivered as a file readable by AI agents. It performs 16 security checks covering code, dependencies, secrets, and containers, and requires no software installation or repository permission grants.
Timeline (last 90 days)
Harden-CI is not a tool that needs to be installed, but rather a document intended to be read by AI agents.
The way to use Harden-CI is to open an AI agent in the repository directory and send the link https://harden-ci.secmy.app/.
The Harden-CI workflow is divided into four phases: audit, report, you decide, and fix.
The audit phase of Harden-CI performs 16 checks and is entirely read-only, making no changes to any files, branches, or project settings.
The 16 steps of Harden-CI are organized into eight dimensions: code, dependencies, secrets, pipeline, containers, infrastructure, API/production, and security hygiene.
Harden-CI recommends that newly introduced dependency versions should be at least seven days old before being adopted, in order to mitigate the risk of publish-time poisoning attacks.
Harden-CI's secret scanning is performed via betterleaks.
Harden-CI has been open-sourced on GitHub at github.com/SecH0us3/harden-ci.
All Facts (8)
Harden-CI is not a tool that needs to be installed, but rather a document intended to be read by AI agents.
50%UnverifiedThe way to use Harden-CI is to open an AI agent in the repository directory and send the link https://harden-ci.secmy.app/.
50%UnverifiedThe Harden-CI workflow is divided into four phases: audit, report, you decide, and fix.
50%UnverifiedThe audit phase of Harden-CI performs 16 checks and is entirely read-only, making no changes to any files, branches, or project settings.
50%UnverifiedThe 16 steps of Harden-CI are organized into eight dimensions: code, dependencies, secrets, pipeline, containers, infrastructure, API/production, and security hygiene.
50%UnverifiedHarden-CI recommends that newly introduced dependency versions should be at least seven days old before being adopted, in order to mitigate the risk of publish-time poisoning attacks.
50%UnverifiedHarden-CI's secret scanning is performed via betterleaks.
50%UnverifiedHarden-CI has been open-sourced on GitHub at github.com/SecH0us3/harden-ci.
50%