CheckOps home

Tools directory

P

CheckOps

poutine

poutine by BoostSecurity is an Apache-2.0 scanner that detects misconfigurations and vulnerabilities in GitHub Actions and GitLab CI pipelines, for one repo or a whole organisation.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

poutine detects misconfigurations and vulnerabilities in a repository’s build pipelines, parsing CI workflows from GitHub Actions and GitLab CI/CD. Given a read-level access token, it can analyse all repositories in an organisation to quickly assess software supply chain posture.

It runs as a binary, a Docker image or a GitHub Action, and can upload SARIF results to GitHub code scanning. Rules can be skipped per run or configured in a file. The name is a Montreal nod: in French, poutine can also mean messy, like modern supply chains.

The source code is at boostsecurityio/poutine on GitHub under the Apache-2.0 licence, with about 535 stars; the most recent commit was on 21 October 2026.

Features

  1. GitHub Actions and GitLab CI: Both parsed.
  2. Org-wide analysis: Scan all repos with a token.
  3. Rule configuration: Skip or configure rules.
  4. SARIF output: Code scanning integration.
  5. Docker and Action: Easy to run.

Pros

  1. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
  2. Actively maintained: The repository had commits as recent as 21 October 2026.

Cons

  1. Pipeline-only: Does not scan application code.
poutine analyze_local .
poutine analyze_repo org/repo --token "$GH_TOKEN"
poutine analyze_org org --token "$GH_TOKEN"
docker run -e GH_TOKEN ghcr.io/boostsecurityio/poutine:latest

Resources:

Pricing

poutine is free and open source under the Apache-2.0 licence.

  1. Security teams auditing CI pipelines across an organisation.

Conclusion

poutine is a fast way to find risky CI configurations at scale.

Run it with zizmor for overlapping coverage.

On CheckOps, poutine is filed under the Release & CI gates and Security testing stages. Related tools listed here include zizmor, actionlint, Semgrep, Socket, CodeQL and OSV-Scanner. When comparing them, weigh the licence, the languages and platforms each supports, whether it is self-hosted or managed, and how cleanly it slots into your existing CI pipeline. Details on this page were checked against the official website, documentation and repository on 11 November 2026.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with poutine side by side.