What is software pipeline security posture?

It is the security configuration of your SCM and CI systems — branch protection, required reviews, Actions token scope, secret scanning, and more. SBOMVault scores these per repository because most supply-chain compromises exploit weak pipeline controls rather than a vulnerable dependency.

Which checks does SBOMVault run?

Branch protection, required PR reviews, force-push, required status checks, enforce-admins, signed commits, secret scanning + push protection, Dependabot vulnerability alerts, the default Actions token permission (read vs write), and whether Actions can approve pull requests — combined into a weighted 0–100 score.

Which SCM platforms are supported?

GitHub (github.com and self-hosted GitHub Enterprise Server) and GitLab (gitlab.com and self-managed). Reading branch protection and pipeline settings requires an admin/maintainer-scoped token on the repository, and every self-hosted host is SSRF-guarded. The universal controls — branch protection, reviews, force-push, pipeline-must-succeed, signed commits — plus secret detection and dependency scanning are scored on both platforms (secret detection / dependency scanning are detected from the GitLab CI config or Auto DevOps). A few checks stay GitHub-only (secret push protection, Actions token scope, Actions-can-approve-PRs, enforce-admins).

What happens if a setting can’t be read?

It is reported as unknown rather than a failure, so a repository is never penalized for a setting the token lacked permission to read. The posture score reflects only what was actually verified.

Pipeline Security Posture

Most supply-chain breaches exploit the pipeline, not a dependency

An unprotected branch or an over-privileged Actions token is how attackers ship malicious code — no CVE required. SBOMVault scores the SCM/CI posture of your connected repositories and tells you exactly what to fix.

WHAT WE CHECK

The misconfigurations that get repos popped

SBOMVault reads the SCM and CI settings of each connected repository and turns them into a weighted 0–100 posture score, with a clear pass / fail / unknown and a fix for every check. A setting the token can't read is reported as unknown — never silently scored as a pass.

Branch protection & required reviews

Flags an unprotected default branch or zero required approving reviews — unreviewed code reaching production.

Force pushes blocked

Flags default branches that allow force pushes, where history can be rewritten to hide changes.

Default Actions token is read-only

Flags a read-write default GITHUB_TOKEN — a compromised workflow that could push code or cut releases.

Actions cannot approve PRs

Flags the setting that lets a workflow self-approve and bypass human review.

Protection applies to admins

Flags rules that admins can bypass — advisory protection for the highest-privilege accounts.

Required status checks

Flags branches that merge without CI / security gates passing.

Secret scanning & push protection

Flags repositories where committed secrets can go undetected, or be pushed before detection.

Dependabot alerts & signed commits

Flags disabled vulnerability alerts and missing signed-commit requirements.

What it is — and what it isn't

Pipeline posture scans the GitHub and GitLab repositories your organization has connected — including self-hosted GitHub Enterprise Server and self-managed GitLab (the per-host token is used and every custom host is SSRF-guarded). Reading branch protection and pipeline settings needs an admin/maintainer-scoped token on the repo.

Reads are best-effort: a check the token can't see is reported as unknown rather than a failure, so a repository is never penalized for a setting we couldn't read. The score reflects only what was actually verified.

The universal controls (branch protection, required reviews, force-push, pipeline-must-succeed, signed commits) are scored on both platforms — and so are secret detection and dependency scanning (read from GHAS / Dependabot on GitHub, and from your CI config / Auto DevOps on GitLab). A few checks remain GitHub-only — secret push protection, the default Actions token scope, Actions-can-approve-PRs, and enforce-admins — where GitLab has no equivalent.

Harden the pipeline, not just the dependencies

Connect GitHub or GitLab and the Pipeline Posture dashboard scores every repository SBOMVault has seen — with the exact misconfiguration and the fix.

Start for free Talk to us

EXPLORE MORE

Frequently asked questions

What is software pipeline security posture?: It is the security configuration of your SCM and CI systems — branch protection, required reviews, Actions token scope, secret scanning, and more. SBOMVault scores these per repository because most supply-chain compromises exploit weak pipeline controls rather than a vulnerable dependency.
Which checks does SBOMVault run?: Branch protection, required PR reviews, force-push, required status checks, enforce-admins, signed commits, secret scanning + push protection, Dependabot vulnerability alerts, the default Actions token permission (read vs write), and whether Actions can approve pull requests — combined into a weighted 0–100 score.
Which SCM platforms are supported?: GitHub (github.com and self-hosted GitHub Enterprise Server) and GitLab (gitlab.com and self-managed). Reading branch protection and pipeline settings requires an admin/maintainer-scoped token on the repository, and every self-hosted host is SSRF-guarded. The universal controls — branch protection, reviews, force-push, pipeline-must-succeed, signed commits — plus secret detection and dependency scanning are scored on both platforms (secret detection / dependency scanning are detected from the GitLab CI config or Auto DevOps). A few checks stay GitHub-only (secret push protection, Actions token scope, Actions-can-approve-PRs, enforce-admins).
What happens if a setting can’t be read?: It is reported as unknown rather than a failure, so a repository is never penalized for a setting the token lacked permission to read. The posture score reflects only what was actually verified.