Trajan: CI/CD Pipeline Attacks
Trajan scans GitHub Actions, GitLab CI/CD, and Azure DevOps pipelines for supply-chain and CI/CD security risks, surfacing misconfigurations, excessive permissions, and exploitable vulnerabilities — and can now run as a native GitHub Action with verification chains for confirmed findings.
Secure Your Software Supply Chain with Trajan
Your CI/CD pipelines are part of your attack surface. Trajan, available as part of the Praetorian Guard Platform, gives your security team complete visibility into pipeline vulnerabilities across GitHub Actions, GitLab CI/CD, Azure DevOps, and Jenkins — from a single unified engine.
Why This Matters
Modern software delivery pipelines are increasingly targeted by attackers. Poisoned pipeline execution, secrets exposure, dependency hijacking, and self-hosted runner abuse are real threats that traditional security tools miss. Trajan closes this gap by bringing the same rigorous, offensive-minded approach Praetorian applies to your cloud and application security — directly to your CI/CD infrastructure.
Supported Platforms
Trajan provides end-to-end coverage across the following CI/CD platforms:
What You Get
Cross-Platform Coverage A unified analysis engine across GitHub Actions, GitLab CI/CD, Azure DevOps, and Jenkins. One engine, consistent results across your entire pipeline estate.
Comprehensive Detection 32 detection plugins covering expression injection, unsafe checkouts, unpinned dependencies, secrets leakage, self-hosted runner risks, artifact and cache poisoning, TOCTOU race conditions, and access control misconfigurations. The detection DSL engine is platform-dispatched, loading and evaluating the appropriate rule catalog for each platform at runtime.
Validated Exploitability 24 attack plugins that validate whether identified vulnerabilities are actually exploitable. Every finding is backed by proof.
AI/LLM Pipeline Security As AI services increasingly appear in CI/CD pipelines, Trajan integrates with Julius and Augustus to identify AI service fingerprints and test for adversarial prompt injection across 210+ attack payloads.
Running Trajan as a GitHub Action
Trajan ships a root composite Action that lets you embed the full scan pipeline directly into any GitHub Actions workflow. The Action builds Trajan from source pinned to the referenced Action ref, then runs the complete collect → normalize → scan → report sequence automatically.
Quick Start
Add the following step to any workflow job:
- uses: praetorian-inc/trajan@<ref>
Replace <ref> with the desired tag or commit SHA.
Action Outputs
After the scan completes, the following outputs are available to downstream steps:
HTML, Markdown, and JSONL reports are automatically uploaded as workflow artifacts on every run.
CI Failure Thresholds
You can configure the Action to fail the workflow run when the finding count exceeds a defined threshold. This makes it practical to enforce a hard gate in pull-request or merge checks.
When token permissions limit the scope of what Trajan can collect, the Action sets a degraded coverage state flag rather than failing silently, so downstream steps and reviewers can account for reduced scan depth.
Verification Chains for GitHub
For applicable GitHub Actions findings, Trajan can go beyond detection to confirm whether a detected misconfiguration is actually reachable in your environment.
How Verification Chains Work
A verification chain is a YAML plan that defines a short, authorized sequence of API calls issued against your own environment. Before any requests are made, all validation errors in the plan are returned offline, so you can review and correct the configuration without side effects. Requests are only issued after the plan passes validation.
The result is a finding state of confirmed reachable rather than suspected present — giving remediation teams higher-confidence signal to prioritize work.
What This Changes for Triage
Verification chains apply to GitHub findings only at this time. All calls are authorized and scoped to the customer's own environment.
Platform-Specific Collection Details
GitLab CI/CD
Trajan collects the following from the GitLab API:
- Projects, groups, runners, and branch protections
- CI/CD variables and secret metadata
- Token scope
.gitlab-ci.yml pipelines are normalized into per-job fact records and evaluated against the same detection-rule DSL used for GitHub Actions, producing findings for misconfigurations, excessive permissions, and supply-chain risks.
Self-hosted GitLab instances are supported via a --url flag. Self-signed certificates are also supported.
Azure DevOps
Trajan walks ADO organizations and projects and:
- Resolves each pipeline's
extends/template closure - Emits structural node and edge records with settings-resolution joins, including job auth-scope clamping, branch-policy attribution, and ACL bit-decode with group expansion
- Produces derived taint edges for use by the detection engine
How It Fits Into Guard
Trajan extends the Guard Platform's attack surface management to your software delivery infrastructure. Pipeline scan results flow into your existing Guard dashboard alongside your cloud, network, and application security findings — giving you a unified view of organizational risk.
Three Core Workflows:
- Enumerate — Map your CI/CD access and attack surface with credential and permission validation
- Scan — Run detection plugins against pipeline configurations to identify vulnerabilities
- Attack — Validate exploitability through built-in attack modules with explicit opt-in and full session tracking
Get Started
Trajan is available now. To embed Trajan in a GitHub Actions workflow, add uses: praetorian-inc/trajan@<ref> to any workflow step. Reach out to your Praetorian engagement team to add CI/CD pipeline security to your Guard Platform coverage.