Home

Trajan Wiki

Trajan is a CI/CD security scanner that detects and exploits pipeline vulnerabilities across five platforms.

Platforms

Platform	Enumerate	Scan	Attack	Retrieve
GitHub	token, repos, secrets	11 detections	9 plugins + chains	secrets-dump artifacts
GitLab	token, projects, groups, secrets, branch protections, runners	8 detections	3 plugins	—
Azure DevOps	token, projects, repos, pipelines, variable groups, connections, secure files, agent pools, users, groups, branch policies, search, fork security, attack paths	6 detections	9 plugins	secrets-dump artifacts
Jenkins	access, jobs, nodes, plugins	7 detections	3 plugins	—
JFrog	—	token-info, secrets	—	—

Authentication

Every platform uses either a token or username/password. Set credentials via environment variables or CLI flags:

Platform	Env Variable	Flag
GitHub	GH_TOKEN	--token
GitLab	GITLAB_TOKEN	--token
Azure DevOps	AZURE_DEVOPS_PAT	--token
Jenkins	JENKINS_USERNAME + JENKINS_PASSWORD	--username + --password
JFrog	JFROG_TOKEN	--token

Output

All scan and enumerate commands default to console output. Use -o json for JSON:

trajan github scan --repo owner/repo -o json > results.json

Links

• GitHub README
• Issues