Supported misconfiguration detectors

XyDocs






  
    XyDocs
    CI/CD Misconfigurations Detectors
  


  

  


Supported misconfiguration detectors



The following are the misconfiguration detectors available, categorized by family / tool.




CI/ CD Security




Docker container action should pin its image by digest


Composite action should pin the actions it uses by commit SHA


Ensure that CI/CD apps do not use too broad permissions


Build attestation framework should be used


CI/CD Bot should not be able to approve a code review


CI/CD argument values should not flow directly into workflows


Workflows should not use insecure commands


Secrets used in workflows should not be echoed in the console


Secrets and Credentials at organization level should not widely shared


Repository should be associated with an approved CI/CD app


Secrets should be stored explicitly as encrypted GitHub Actions Secrets


Potential injected malicious code into files referenced by the pipeline configuration file


Pull Requests do not execute the pipelines modifications that they include


Suspicious Pull Request merge invocation


Signed Container Images


Ensure that groups do not use too broad permissions.


Branches configured to trigger a pipeline exposed to secrets has a correlating branch protection rule in the SCM


Webhook URL is not allowed


Avoid calls to Jenkins getInstance method


Unusual activity at CI/CD environments should be monitored






CI/ CD tools




Lack of administrative monitor and logging


Workflow permissions are not minimal


Dangerous Workflow


Dependency Update Tool


Fuzzing


Inadequate Backups of Jenkins Instance


Ensure all external dependencies used in the build process are locked


SAST in use


Ensure scanners are in place to identify and prevent sensitive data in pipeline files


Token Permissions


Lack of Secure Authentication


Lack of Secure Authorization


Unsecured Communication


Secure Jenkins version


Use of Deprecated or Vulnerable Plugins






CI/CD Security




Malicious script in a CI/CD pipeline.






Confusing Names




PyPI Confusing Names






Container Security




ADD instead of COPY


apt-get dist-upgrade used


Container runs as root


COPY with multiple sources must end destination with /


Deprecated MAINTAINER used


Multiple CMD instructions


Multiple ENTRYPOINT instructions


WORKDIR path is not absolute


No HEALTHCHECK defined


apt-get missing –no-install-recommends


RUN package-manager update instruction alone


Exposed port out of range


apk add is missing --no-cache


'dnf clean all' missing


'microdnf clean all' missing


'yum clean all | packages' missing


'zypper clean' missing


RUN using sudo


SSH port exposed


WORKDIR should not be mounted on system dirs






Cryptography




HSTS max-age configured too short, or disabled


Configuration setting that disables transport or storage cryptography


Weak cipher suite offered by configuration


Broken or deprecated algorithm chosen by configuration


Deprecated TLS or SSL version enabled by configuration


Work factor configured below the accepted minimum






HTTP With Remote Repositories




Maven Use HTTPS with remote repositories


NuGet Use HTTPS with remote repositories


PyPI Use HTTPS with remote repositories






Identity Security




Wildcard redirect URI in Keycloak realm






Lack of Version Pinning




NPM Lack of Version Pinning


NuGet Lack of Version Pinning


PyPI Lack of Version Pinning






Malicious Image




Reverse Shell in Container Image






Open Versions




Maven Avoid Open Versions






Package managers




Insecure Package Registry webhook






Releases




Signed Releases






Source Code Management (SCM)




Binary artifacts found


Code Review


Dockerfile copies build context with no .dockerignore


Environment file under version control


Ineffective GitHub ruleset


Project has no .gitignore


No Infrastructure-as-Code security scan in the pipeline


Risky third-party apps installed on the organization


Ensure issues deletion is limited to specific users


Ensure maximum number of administrators are set for the organization


Insecure MCP server transport


AI model reference not pinned by digest


Cloud login uses a long-lived credential instead of OIDC


Ensure strict base permissions are set for repositories


Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)


Ensure pipelines are automatically scanned for vulnerabilities


No pre-commit security scan


Branch/ref protection is not enforced or is bypassable


Ensure two administrators are set for each repository


Ensure repository creation is limited to specific members


Ensure repository deletion is limited to specific users


Secure-development governance policies missing


Security Policy


Self-hosted runner exposed to untrusted fork code


Ensure verification of signed commits for new changes before merging


Stale (inactive) VCS committer identities


Ensure all checks have passed before merging new code


The Software Bill of Materials (SBOM) is not produced


Tags are not immutable


Unprotected branch


Vulnerabilities


Insecure Webhook






URL dependency




NPM URL Dependency


PyPI URL Dependency






Usage Of Public Repositories




Maven Avoid Public Repositories


NPM Avoid Public Repositories


NuGet Avoid Public Repositories


PyPI Avoid Public Repositories



  © 2026 Xygeni. All rights reserved