Find the security problems in your `.gitlab-ci.yml` before a runner does.

glsec is a static security linter for GitLab CI/CD pipelines. It catches mutable images and includes, script injection through branch names and commit messages, leaked secrets and unprotected deployments. It runs offline as a single binary and never executes your pipeline.

Install Browse the rules

85rules 8/10OWASP CI/CD risks 0network calls

$ glsec bad-pipeline.yml
error[GL001]: image "node:latest" uses mutable tag "latest" — pin to a specific version or digest
  --> bad-pipeline.yml:17:10 (job: build)
   |
17 |   image: node:latest
   |          ^

warn[GL002]: unquoted user-controlled variable $CI_COMMIT_REF_NAME in script — value is set by commit authors and may contain shell metacharacters
  --> bad-pipeline.yml:44:7 (job: test)
   |
44 |     - echo Running tests for $CI_COMMIT_REF_NAME
   |       ^

error[GL003]: project include "platform/ci-templates" uses mutable ref "main" — pin to a commit SHA or tag
  --> bad-pipeline.yml:6:10
  |
6 |     ref: main
  |          ^

… and 16 more findings: see the full report

Every finding names the rule, the line and the job. Each rule has a page with the risk, what is flagged and a safe alternative, for example GL001 and GL011.

Install

GitLab CI/CD component

include:
  - component: gitlab.com/glsec-io/glsec/glsec@v1.0.25

From the CI/CD Catalog. A second component reports findings in the merge request's Code Quality widget.

Homebrew

brew install glsec/tap/glsec

macOS and Linux. The tap takes a release only after its archives pass the provenance check.

Docker

docker run --rm -v "$PWD:/src:ro" -w /src \
  ghcr.io/glsec/glsec:1.23.0

Signed with cosign, with SLSA provenance and an SBOM.

Binary

curl -sSLO https://github.com/glsec/glsec/releases/download/v1.23.0/glsec_1.23.0_linux_amd64.tar.gz
tar xzf glsec_1.23.0_linux_amd64.tar.gz

Linux, macOS and Windows on the release page. Or go install github.com/glsec/glsec/cmd/glsec@v1.23.0.

Claude Code plugin

/plugin marketplace add glsec/glsec
/plugin install glsec@glsec

Adds /glsec:scan, which scans the project and has Claude explain and fix each finding, and a hook that scans a .gitlab-ci.yml or .gitlab/*.yml file after Claude edits it. Without a glsec on your PATH it downloads the release binary and checks it against checksums.txt and, with cosign or the GitHub CLI installed, its signed provenance. Linux and macOS; the edit hook needs jq. Details in the README.

Also available as a pre-commit hook and a MegaLinter plugin. Output formats: text, table, JSON, SARIF, GitLab Code Quality and JUnit, with an example of each. See the README for every option, and Verifying a release to check a download before you run it.

Find the security problems in your .gitlab-ci.yml before a runner does.