Jenkins Security

Jenkins security relies on the Credentials Binding Plugin, Role-Based Access Control, and a mature plugin ecosystem for security scanning. As a self-hosted platform, security posture depends entirely on operator configuration and maintenance.

Credentials Plugin provides encrypted storage for secrets (username/password, SSH keys, secret files, certificates). Credentials can be scoped to folders, jobs, or global. External secrets integration with HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and CyberArk.

Role-Based Access Control (RBAC) plugin enables fine-grained permissions. Matrix Authorization Strategy and Project-based Matrix Authorization provide flexible access models. Integration with LDAP, Active Directory, SAML, and OIDC for enterprise identity.

Pipeline sandboxing via Groovy Sandbox restricts script execution. Script Security Plugin approves/denies script operations. Pipeline step whitelisting/blacklisting. Declarative pipelines enforce structure and reduce attack surface.

Plugins for SAST (SonarQube, Checkmarx, Fortify), DAST (OWASP ZAP, Burp), dependency scanning (OWASP Dependency Check, Snyk), container scanning (Anchore, Trivy, Aqua), and secret detection (TruffleHog, GitLeaks).

Self-hosted means you control the OS, JVM, network, and updates. Requires dedicated expertise for JVM tuning, plugin security updates, backup/DR, and monitoring. No vendor-managed security patches — you own the full stack.