Praetorian has released Trajan, an open-source CI/CD security tool that unifies vulnerability detection and attack validation across GitHub Actions, GitLab CI, Azure DevOps, and Jenkins in a single cross-platform engine. It replaces the earlier platform-specific Gato and GitLab CI tools with 32 detection plugins and 24 attack plugins. Coverage includes poisoned pipeline execution, secrets exposure, self-hosted runner risks, supply chain attacks, and AI/LLM pipeline vulnerabilities. The tool has three modules: Enumerate (maps access and attack surface), Scan (runs detection plugins against pipeline configs), and Attack (validates exploitability). It also integrates with Julius for AI service fingerprinting and Augustus for adversarial prompt injection testing with 210+ payloads. Trajan even compiles to WebAssembly for in-browser use. Available now on GitHub with prebuilt binaries for Linux, macOS, and Windows.
