# How does Jenkins verify plugins before publishing for consumption? **URL:** \ **Category:** Infrastructure\ **Tags:** plugin-site, sig-security\ **Created:** [August 1, 2022, 7:18pm UTC](https://community.jenkins.io/t/how-does-jenkins-verify-plugins-before-publishing-for-consumption/3225 "2022-08-01T19:18:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sslk](https://avatars.discourse-cdn.com/v4/letter/s/e8c25b/32.png) [@sslk](https://community.jenkins.io/u/sslk)\ **Post date:** [August 1, 2022, 7:18pm UTC](https://community.jenkins.io/t/how-does-jenkins-verify-plugins-before-publishing-for-consumption/3225/1 "2022-08-01T19:18:12Z")
Since plugins are created by the community, how does the Jenkins teams run security scans on the plugins **before** publishing the plugin for other users to consume? went through the following pages but did not find an answer to my specific question. > **[How We Schedule Security Advisories](https://www.jenkins.io/security/scheduling/)** > > Jenkins – an open source automation server which enables developers around the world to reliably build, test, and deploy their software > **[Handling Vulnerabilities in Plugins](https://www.jenkins.io/security/plugins/)** > > Jenkins – an open source automation server which enables developers around the world to reliably build, test, and deploy their software follow up is - what type of scans does the Jenkins team perform on the plugins as part of their security scans? ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [August 1, 2022, 9:33pm UTC](https://community.jenkins.io/t/how-does-jenkins-verify-plugins-before-publishing-for-consumption/3225/2 "2022-08-01T21:33:30Z")
> [@sslk](#): > > how does the Jenkins teams run security scans on the plugins **before** publishing the plugin for other users to consume? It depends on what you mean by “security scans on the plugins”. If you mean “run spotbugs to report Java issues”, then that is a standard part of recent releases of the plugin pom and is part of plugin builds when they update to recent releases of the plugin pom. You can see the results of those reports on [ci.jenkins.io](http://ci.jenkins.io) for plugins like [git plugin](https://ci.jenkins.io/job/Plugins/job/git-plugin/job/master/lastSuccessfulBuild/spotbugs/), [LDAP plugin](https://ci.jenkins.io/job/Plugins/job/ldap-plugin/job/master/lastSuccessfulBuild/spotbugs/), [mailer plugin](https://ci.jenkins.io/job/Plugins/job/mailer-plugin/job/master/lastSuccessfulBuild/spotbugs/), and many more If you mean “run spotbugs find-sec-bugs to report security specific Java issues”, then that is an optional check that is described in > **[Findsecbugs for Developers](https://www.jenkins.io/blog/2020/03/02/findsecbugs/)** > > Adding findsecbugs to spotbugs for detecting common security bugs If you mean “run Jenkins specific source code security checks”, then that is an optional check that is described in: > **[How to use the Jenkins Security Scan](https://www.jenkins.io/doc/developer/security/scan/)** > > Jenkins – an open source automation server which enables developers around the world to reliably build, test, and deploy their software If you mean “run a dependency vulnerability scanner”, then that is not being run as far as I know. If you mean something different than any of those items, please provide more details about what you mean by “does Jenkins run security scans on the plugins before publishing”. ---
**Author:** ![sslk](https://avatars.discourse-cdn.com/v4/letter/s/e8c25b/32.png) [@sslk](https://community.jenkins.io/u/sslk)\ **Post date:** [August 2, 2022, 12:18am UTC](https://community.jenkins.io/t/how-does-jenkins-verify-plugins-before-publishing-for-consumption/3225/3 "2022-08-02T00:18:52Z")
> [@MarkEWaite](#): > > run Jenkins specific source code security check Thanks for the reply Mark, it is helpful. i’m looking to do OSS scanning and malware scanning, apologies for not clarifying that earlier. do you know what is used to help make the [Security Advisories](https://www.jenkins.io/security/advisories/) report ? what type of tools are being used to detect these vulnerabilities? ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [August 2, 2022, 12:45am UTC](https://community.jenkins.io/t/how-does-jenkins-verify-plugins-before-publishing-for-consumption/3225/4 "2022-08-02T00:45:58Z")
> [@sslk](#): > > do you know what is used to help make the [Security Advisories](https://www.jenkins.io/security/advisories/) report ? The report is generated from a YAML data file. The data file provides the information and a template is used to format the information into that table layout. > [@sslk](#): > > what type of tools are being used to detect these vulnerabilities? I believe that the Jenkins security team uses multiple techniques to search for security bugs. When they detect a common pattern, they will consider placing that common pattern into the Java source code scanner tool mentioned earlier. They also accept security bug reports from security researchers around the world. ---
**Author:** ![sslk](https://avatars.discourse-cdn.com/v4/letter/s/e8c25b/32.png) [@sslk](https://community.jenkins.io/u/sslk)\ **Post date:** [August 2, 2022, 1:38am UTC](https://community.jenkins.io/t/how-does-jenkins-verify-plugins-before-publishing-for-consumption/3225/5 "2022-08-02T01:38:20Z")
Got it. If possible, could you elaborate on ‘multiple techniques’, what type of techniques? I just want to know so I can understand how robust the security scanning is from Jenkins’ side. ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [August 2, 2022, 1:50am UTC](https://community.jenkins.io/t/how-does-jenkins-verify-plugins-before-publishing-for-consumption/3225/6 "2022-08-02T01:50:27Z")
Sorry, but I don’t know enough details of the techniques they use. ---
**Author:** ![sslk](https://avatars.discourse-cdn.com/v4/letter/s/e8c25b/32.png) [@sslk](https://community.jenkins.io/u/sslk)\ **Post date:** [August 2, 2022, 1:51am UTC](https://community.jenkins.io/t/how-does-jenkins-verify-plugins-before-publishing-for-consumption/3225/7 "2022-08-02T01:51:28Z")
got it - thanks for your help Mark!