CI/CD Goat
Capture flags in a deliberately insecure CI/CD pipeline on your machine
CI/CD Goat is a deliberately insecure build pipeline that you run locally. It starts a set of services, such as a Git server, a CI server and a registry, plus a scoreboard of challenges. Each challenge asks you to find a weakness in how the pipeline is configured and capture a flag.
Free · No login · Server · Intermediate
About CI/CD Goat
It trains CI/CD security and the risks around pipelines, build scripts and stored secrets. It suits DevOps engineers and security people who already know Git and basic CI.
It runs on your own machine with Docker Compose. It is free and open source, and needs no account.
On Breakpoint since 25 Oct 2026.
Made this game? Claim it →
Tips and discussion
No tips yet. Solved it? Share how, and wrap answers in ||spoilers||.