Plumber: Open-source scanner of GitLab CI/CD pipelines for compliance gaps

Plumber is an open-source GitLab CI/CD compliance scanner that automates detection of insecure pipeline configurations—such as mutable container tags, untrusted registries, inadequate branch protection, missing templates, and mutable include references. It can run as a CLI or as a CI component, outputs colorized and optional JSON reports, requires a personal access token with read scopes and Maintainer access, and is available under the MPL-2.0 license with prebuilt binaries for major platforms.