Information Technology

Map source repositories, continuous integration services, runners, artifact stores, deployment systems, and signing infrastructure. Identify which identities can modify code, approve changes, access secrets, or publish releases. Separate these permissions where practical so one compromised account cannot silently control the entire delivery path.

Use Librarian to organize dependencies and ownership. Review build-service integrations through Relay with limited permissions. A pipeline assessment should include configuration changes and administrator activity, not just application scanning. Production-affecting tests and permission changes require explicit approval from accountable owners.

• Restrict untrusted contributions from accessing build secrets.
• Separate release approval from routine repository administration where feasible.

Maintain a useful inventory of third-party components and the software you distribute. Track dependency origin, supported versions, and the process for responding to a malicious or vulnerable package. A software bill of materials supports this work, but it is not a guarantee of component integrity.

Argus can inform exposed-credential reviews, while Hunter can support vulnerability investigation. Rotate confirmed compromised secrets and examine where they were usable, rather than merely deleting them from a repository. Protect signing credentials and update channels with restrictive access and reviewable release records.

• Check logs, artifacts, and documentation for accidental secret exposure.
• Document how customers will receive a revoked or corrected release.

Prioritize findings by actual exposure, privilege, and operational consequence. Use Verification & Response for approved validation and Lancer for scoped testing when deeper assessment is warranted. Avoid treating a raw vulnerability score as the sole reason to interrupt a critical service.

Shield + SHADE and InfraAsAI can support remediation workflows within human-approved policies. Growler can help preserve investigation evidence, and Dewey can support recovery coordination. Test restoration of identity, build infrastructure, and trusted artifacts so recovery does not simply reintroduce a compromised pipeline or configuration.

• Require rollback plans for consequential infrastructure changes.
• Track findings through remediation and independent confirmation where appropriate.