PipeAudit

Professional Azure DevOps extension that audits Azure Pipelines YAML definitions for compliance, security risks, and best practices. PipeAudit runs inside your Azure DevOps organization and generates a health score and actionable report for every pipeline — using local rules, not AI.

Features

Feature	Description
Unpinned Task Detection	Flags tasks that do not specify a pinned version (e.g. missing `@1.2.3`).
Hardcoded Secret Detection	Scans for inline passwords, tokens, API keys, and secrets in pipeline YAML.
Missing Approval Gates	Detects environment deployments without approval checks.
Job Timeout Validation	Identifies jobs missing `timeoutInMinutes` to prevent stuck agents.
Health Score	Each pipeline receives a 0–100 compliance score based on issue severity.
Issue Categorization	Issues are classified as Critical, Warning, or Info with suggested fixes.

Installation

Download the .vsix from the Releases page.
In Azure DevOps, go to Organization settings → Extensions.
Click Browse, choose the .vsix file, and upload it.
Add the PipeAudit hub to your project's overview page.

Permissions

PipeAudit requests only the minimum scopes required to read pipeline definitions:

Scope	Purpose
`vso.build`	Read build and pipeline definitions.
`vso.pipelines`	Read pipeline metadata and runs.

PipeAudit does not:

Write, modify, or delete any pipeline.
Access source code outside pipeline YAML.
Send data to any external service.

Privacy Policy

See PRIVACY.md.

Licensing

PipeAudit is licensed under the MIT License.

Support

See SUPPORT.md.

Documentation

PipeAudit is presented directly in the Azure DevOps web UI as a project hub. Open the PipeAudit tab from your project overview to view the audit dashboard.

How the Health Score is Calculated

Starts at 100.
−25 points for each Critical issue (e.g. hardcoded secret).
−10 points for each Warning issue (e.g. unpinned task, missing approval).
−5 points for each Info issue (e.g. missing job timeout).
Minimum score is 0.

Rules Reference

Rule ID	Rule Name	Severity	What it checks
`unpinned-task`	Unpinned Task Version	Warning	Tasks without a pinned version number.
`hardcoded-secret`	Possible Hardcoded Secret	Critical	Inline passwords, tokens, or keys in YAML.
`missing-approval`	Missing Approval Gate	Warning	Environment deployment without approval.
`no-timeout`	Job Without Timeout	Info	Jobs missing `timeoutInMinutes`.
`fetch-error`	Unable to Read YAML	Critical	Pipeline YAML could not be retrieved.

Q&A Responsiveness

We are committed to answering all questions and support requests within 7 business days. Open an issue in the extension's repository or contact the publisher through the Visual Studio Marketplace listing.

Ratings and Reviews

Your feedback helps us improve. Please rate and review PipeAudit on the Visual Studio Marketplace. Reviews are read and considered for every release.

Maintenance Commitment

This extension is actively maintained. Issues receive a first response within 7 days. If the extension is ever discontinued, a 90-day notice will be published before delisting.

Publisher

RadwanAlmsora

PipeAudit

Radwan Almsora

PipeAudit

Features

Installation

Permissions

Privacy Policy

Licensing

Support

Documentation

How the Health Score is Calculated

Rules Reference

Q&A Responsiveness

Ratings and Reviews

Maintenance Commitment

Publisher