2026-07-21T20:02:51Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:23684 2025-11-12T12:50:41Z ddc:004 open_access

Vulnerability Detection Across Different CI/CD Platforms Oliveira, Vasco Manuel Simões, Alberto Henriques, Pedro Rangel Software Supply Chain Software Supply Chain Security CI/CD Platforms In recent years, more attention has been paid to the security of the software supply chain (SSC). While at first SSC was just seen as the dependency of other libraries, today SSC is broader, considering all the environment where a software application is developed, from the actors, hardware and auxiliary tools. This work focuses on a specific part of software supply chain security: the tools used for continuous integration and continuous deployment (CI/CD) and their vulnerabilities and risks. These tools are widely used by organizations to accelerate their software development, testing, and delivery, making any security issue present in these tools problematic for the organization. This is especially true given that most tools are open-source, making these tools the primary targets for exploits. We will present a quick introduction to SSCS and CI/CD and provide a practical solution to detect risks and vulnerabilities in CI/CD tools, emphasizing the modular approach, allowing the system to easily scale to detect new risks and vulnerabilities, as well as to support new CI/CD tools. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Vasco Manuel Oliveira and Alberto Simões and Pedro Rangel Henriques 2025 Is Part Of OASIcs, Volume 135, 14th Symposium on Languages, Applications and Technologies (SLATE 2025) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/OASIcs.SLATE.2025.4 urn:nbn:de:0030-drops-236848 https://drops.dagstuhl.de/entities/document/10.4230/OASIcs.SLATE.2025.4 eng https://creativecommons.org/licenses/by/4.0/legalcode