While I was working as a Devops engineer on a platform team I got to spend a lot of time with the Jenkins build server, so much time that I once found a couple of security holes in it. There is a plugin, jenkins-plugin-script-security, which tries to restrict which operations can be performed by Groovy scripts running in Jenkins jobs, but it failed to check some of the more esoteric Groovy language features.

Sadly Jenkins don’t provide any financial incentive for these reports, but I did get a mug and a T-Shirt.