M ManySignal

Use Case: Code & Supply Chain

GitHub repository compromise

A deploy key from a decommissioned CI runner was used to force-push to main at 3 AM. The diff included a new dependency with a backdoored version. ManySignal caught both signals simultaneously.

Book a demo Code attack surface
Attack scenario

When the repository becomes the attack surface

Code repositories are the most valuable and least-monitored assets in most engineering organizations. A compromised deploy key, leaked GitHub PAT, or OAuth app with write access to production repositories gives an attacker the ability to inject malicious code that will be built and deployed by CI/CD pipelines — often automatically, without any human review. The attack surface includes not just the repository content but also the GitHub Actions secrets, environment variables, and cloud credentials that CI/CD pipelines use.

Detection logic 
rule: github_repo_compromise
type: event + code_analysis
sources:
  - github_audit_log
  - github_webhook_push_events
  - github_actions_audit
trigger:
  - OR:
    - condition: push.forced == true AND branch IN protected_branches
    - condition: actor.ip NOT IN known_dev_ip_ranges AND repo IN critical_repos
    - condition: commit_diff.secret_scan_hit == true
    - condition: deploy_key.age_days > 90 OR deploy_key.source == decommissioned_system
enrichments:
  - secret_scan: gitleaks_patterns (150+ types)
  - actor_baseline: commit_history, geolocation
  - pipeline_impact: downstream_deployments
  - repo_exposure: fork_count, clone_events_24h
mitre: T1195.002 (Supply Chain: Software Supply Chain), T1552.001 (Credentials in Files)
Triage agent questions
1

Was a personal access token, deploy key, or OAuth app used for this push — and is it still active?

GitHub audit log
2

Did the push bypass branch protection rules (force-push, admin override)?

GitHub webhook
3

Does the commit diff include added secrets, backdoor code, or dependency changes?

Code diff analysis
4

Is the actor's IP consistent with their normal commit geolocation?

IP geolocation
5

Has this repository been forked or cloned by external accounts in the past 24 hours?

GitHub API
6

Were any CI/CD secrets or GitHub Actions secrets accessed in the pipeline triggered by this push?

Actions audit
Response playbook
1

Revoke the PAT or deploy key used for the unauthorized push

Autonomous
2

Notify the repository owners and security engineering team

Autonomous
3

If secrets detected in commit: rotate all identified credentials immediately

Approve-gated
4

Revert the malicious commit via GitHub API and force-push from last clean state

Approve-gated
5

Scan the full commit history of affected repositories for additional injected content

Autonomous

MITRE ATT&CK mapping

T1195.002 — Compromise Software Supply ChainT1552.001 — Credentials in FilesT1098.004 — SSH Authorized Keys

GitHub compromise FAQ

Does ManySignal monitor GitHub, GitLab, and Bitbucket?

Yes. ManySignal integrates with GitHub (Enterprise and Cloud), GitLab (Self-Managed and SaaS), and Bitbucket via their respective audit log and webhook APIs. The detection logic is normalized across all three platforms.

How does ManySignal detect secrets in committed code?

ManySignal runs a Gitleaks-compatible pattern scanner on every new commit diff. The scanner covers 150+ secret types including AWS keys, GitHub PATs, Stripe keys, Slack tokens, and generic high-entropy strings. Findings are enriched with a confidence score and the exact commit location.

What about repositories that are already public — does exposure matter less?

Public repositories are actually higher priority because exposed secrets can be exploited by anyone. ManySignal monitors public repositories for secret leaks via the same pattern scanner and also correlates with GitHub's own secret scanning alerts. Both internal and external repository exposure are tracked.

Can ManySignal detect insider threats in the code repository — not just external attackers?

Yes. Unusual commit patterns by internal users — committing to repositories outside their normal scope, pushing to production branches outside business hours, committing immediately before resignation — are flagged as behavioral anomalies. The insider risk and code security use cases share the entity graph.

Monitor your code repositories for unauthorized changes

Push events, deploy key audit, and commit secret scanning — all correlated with your pipeline activity.

Book a demo Explore the platform