# Unpinned pipeline image

A GitLab CI, Azure Pipelines, or Cloud Build image or step name that uses latest, or that has no tag and no digest.

Area: Security

## What you need to supply

The pipeline text. The pipeline is not executed.

## If it reports a finding

Medium severity. The suggested next step is to pin a release tag or an image digest.

## What this does not prove

A pinned tag such as node:20 is not this finding. An image named only in a comment is not this finding.

## Image that this check is written to notice

```
image: nginx:latest
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/unpinned-pipeline-image.