Code attack surface

ManySignal ingests GitHub, GitLab, and Bitbucket audit logs via webhook and API. Monitored events include: repository visibility changes (private to public), deploy key additions, collaborator access grants, branch protection rule modifications, workflow file changes (CI/CD YAML), and force pushes to protected branches. All events are correlated with committer identity and access context.

Yes. ManySignal integrates with Gitleaks and detects secret patterns (API keys, private keys, credentials, tokens) in code commits, pull request diffs, and CI/CD workflow files. Detection is near-real-time via webhook, not limited to scheduled scan cycles. When a secret is detected, ManySignal can trigger automatic revocation workflows for supported secret types.

ManySignal monitors workflow YAML files for changes that modify the security posture: adding new secrets access, changing runner environments, modifying artifact upload destinations, or adding self-hosted runner references. Pipeline execution anomalies — unexpected artifacts, unusual execution times, network connections from build hosts — are correlated with the workflow change history to identify abuse.

Yes. ManySignal ingests GitHub Advanced Security alerts (code scanning, secret scanning, dependency review) and correlates them with behavioral signals from the repository and the identity of the committer. A code scanning alert from a committer with unusual access patterns or a departing employee trigger higher-priority investigation workflows.

ManySignal monitors the full build chain: who modified the workflow YAML, which build runners were used, whether the artifact hash at build time matches the hash at deployment, and whether any dependencies were modified between resolution and installation. Anomalies in the build process — unexpected dependency resolution sources, new build runner registrations, artifacts pushed to unexpected registries — are flagged as potential supply chain compromise indicators.

The detection fires within seconds of the commit via webhook. The response workflow options (configurable per secret type) include: automatic revocation of the credential via the issuing service's API (AWS access key revocation, GitHub PAT revocation, Twilio API key revocation), notification to the committer and security team, and creation of an investigation case tracking whether the secret was accessed before revocation. The commit is not automatically deleted — that requires a manual action to preserve the audit trail.

Yes. External collaborators and organization members with repository access are tracked in the entity graph with their access scope, last active timestamp, and recent activity history. When an external collaborator accesses a sensitive repository outside their normal pattern, or when an account that hasn't been active in 30+ days suddenly downloads a large volume of source code, ManySignal flags the activity for review. Automated workflows can revoke repository access via GitHub API pending security review.

ManySignal's code attack surface monitoring provides evidence for several SLSA and NIST SSDF requirements: build integrity verification (artifact hash tracking), provenance documentation (build event logs with committer identity), and access control evidence (repository access audit logs). The evidence export includes build event records formatted for supply chain security framework submissions.