cider-security-research/cicd-goat resource

Health v2 · maintenance only

Adoption not part of the score

2295 stars · 417 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

CI/CD Goat is a deliberately vulnerable CI/CD environment for learning CI/CD security through 11 capture-the-flag challenges. It runs locally via Docker with real Jenkins, GitLab, and Gitea pipelines covering the OWASP Top 10 CI/CD security risks.

Use cases

• learn cicd security hands-on
• practice poisoned pipeline execution attacks
• capture the flag challenges for devsecops
• train security engineers on jenkins and gitlab vulnerabilities
• understand owasp top 10 cicd security risks
• set up a local vulnerable cicd lab

When to choose

• you want practical, scenario-based CI/CD security training in a real pipeline environment
• you need to practice attacks like PPE, PBAC, and dependency chain abuse safely
• you're preparing a security workshop or CTF exercise for engineers

When to avoid

• you need a tool to scan or secure your own production CI/CD pipelines
• you want a general application security CTF rather than CI/CD-specific scenarios
• you can't run multiple Docker containers locally

Facets

learning-resource · maturity maintenance

security penetration-testing vulnerability-scanning developer-tools security developer-tools education windows self-hosted cicd-security capture-the-flag jenkins gitlab gitea owasp-top-10-cicd deliberately-vulnerable devsecops hands-on-lab devops docker linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cider-security-research/cicd-goat")