Wiz Code Adds Security Visibility and Risk Analysis for CI/CD Pipelines
Summary
Wiz Code now inventories CI/CD pipelines and flags risks including dangerous triggers, excessive permissions, exposed secrets, risky AI-agent configurations, and compromised third-party actions.
Key points
- Wiz Code models GitHub Actions workflows, jobs, runners, triggers, and relationships in its Security Graph.
- The platform flags risky workflow configurations, including dangerous triggers such as pull_request_target and excessive permissions.
- New findings address AI agents in CI, including configurations that could let prompt injection abuse CI credentials and access.
- Wiz associates GitHub Actions audit-log events with specific workflows and jobs for added context.
- A CI bill of materials inventories third-party actions and their associated workflows and jobs.
- A new inventory page provides an organization-wide view of pipelines, their risk levels, findings, and activity.
Article Details
- Event Type
- Wiz Code product capability announcement extending security analysis and inventory to CI/CD build environments.
- Impact
- Wiz says the capabilities provide visibility into GitHub Actions workflows, jobs, runners, permissions, triggers, dependencies, and audit-log events. They are intended to surface risky configurations and potential secret leaks, inventory pipeline components, correlate related risks, and help teams assess exposure and remediation priorities. The article also discusses prompt-injection risks involving AI agents in CI and references the Trivy supply-chain attack as an example.
Vendors
GitHubdecisions, writing and committing code, and executing shell commands directly inside their CI workflows. GitHub Actions is one of the most common places this is happening today, but the pattern extends to any CIWizdone to turn those recommendations into simple, effective controls that security teams can actually trust. Wiz changes that today.
Products
GitHub Actionswriting and committing code, and executing shell commands directly inside their CI workflows. GitHub Actions is one of the most common places this is happening today, but the pattern extends to any CI platformTrivytriggers like pull_request_target, the exact misconfiguration class that enabled both Shai Hulud and Trivy, are flagged automatically via CCRs. Risky inputs, potential secret leaks within pipeline definitions, andWiz CodeWiz Code now models, analyzes, and inventories your CI/CD pipelines. Security visibility has traditionally stopped at the code layer, scanning what developers write, but remaining blind to the system that tests andWiz Security Graphworkflow YAML files and models workflows, jobs, runners, and their relationships as objects on the Wiz Security Graph. This means your pipelines are no longer a black box. They're connected, queryable assets with