Scan your CI/CD pipeline definitions for OWASP CI/CD Top 10, SLSA, and supply-chain security issues — right inside your editor. Powered by the pipefort CLI.
Works in VS Code and any Open VSX editor (Cursor, Windsurf, VSCodium, Theia).
Features
- Inline diagnostics — findings appear as squiggles and in the Problems panel, with severity-mapped icons and links to the rule docs at pipefort.com/docs/rules.
- Toxic combinations — Pipefort's signature correlated attack chains are surfaced in a dedicated Pipefort view in the Activity Bar, broken down into stages with a "break the chain" recommendation.
- GitHub Actions and GitLab CI — scans
.github/workflows/*.yml,.gitlab-ci.yml, and included.gitlab-ci/**files. - Auto-managed CLI — the extension downloads a checksum-verified pipefort
binary from GitHub Releases and keeps it up to date. Point it at your own
binary with
pipefort.binaryPathif you prefer. - Quick fixes — "Fix all auto-fixable issues in file" and per-finding
"Suppress with an inline
# pipefort: ignore[...]comment". - Online pin audits — optional typosquat / vulnerable-action detection when a GitHub token is available (env var or your VS Code GitHub sign-in).
Getting started
- Open a repository that contains CI/CD pipeline files.
- The extension activates automatically and runs a workspace scan.
- Review findings in the Problems panel and the Pipefort view.
Run Pipefort: Scan Workspace from the Command Palette any time.
Settings
| Setting | Default | Description |
|---|---|---|
pipefort.binaryPath |
"" |
Path to a pipefort binary (overrides the managed download). |
pipefort.cliVersion |
latest |
latest or a specific tag (e.g. v1.2.3). |
pipefort.onlineAudits |
auto |
auto / on / off — online pin audits (need a GitHub token). |
pipefort.ruleset |
all |
all, owasp, slsa, or a specific SLSA level. |
pipefort.persona |
regular |
regular, pedantic, or auditor. |
pipefort.minConfidence |
LOW |
Minimum confidence to report. |
pipefort.scanOnOpen |
true |
Scan pipeline files when opened. |
pipefort.scanOnSave |
true |
Scan pipeline files when saved. |
pipefort.scanOnStartup |
true |
Full workspace scan on activation. |
pipefort.extraArgs |
[] |
Extra CLI arguments. |
How online audits stay fast
Save/open scans always run --offline for instant feedback. Online pin audits
(which call the GitHub API) run on startup and manual workspace scans, plus a
cooldown-gated per-file refresh after saves — so editing never hammers the API.
Privacy
Your GitHub token is only ever passed to the CLI via its environment, never on the command line, and is scrubbed from the extension's output channel.
License
MIT
