[herge]

We use jenkins for CI, but only on our QA server. I haven't found a way to do CI without giving Jenkins full credentials on our server.

Jenkins is very powerful, but I would not trust it (or any of the myriad plugins we have installed) to not have security holes.

[ktt]

Yep. Not long ago a remote code execution hole in Java was found. Fortunately Jenkins was quickly patched: https://jenkins-ci.org/content/mitigating-unauthenticated-re...