Living off the pipeline
A research project inventorying RCE-by-design features and code execution risks in CI/CD pipeline tools.
What is Living off the pipeline?
Living Off the Pipeline (LOTP) is a supply chain security research project that inventories development tools commonly used in CI/CD pipelines to document their lesser-known RCE-by-design features and arbitrary code execution risks. It helps identify how these tools can be exploited when processing untrusted code changes or through workflow injection, addressing vulnerabilities in the software supply chain.
Security researchers, DevSecOps engineers, and development teams focused on securing CI/CD pipelines and understanding tool-level exploitation risks.
LOTP provides a centralized, community-driven resource for uncovering hidden security flaws in pipeline tools, inspired by projects like GTFOBins, offering practical insights for vulnerability assessment and mitigation in modern development workflows.
Overview
Supply Chain Security Research - Living Off The Pipeline tools
Use Cases
Best For
- Identifying RCE vulnerabilities in CI/CD tooling
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
