Platform, DevOps and SRE

The pipeline is the highest-privilege system most organisations own and the one with the least observability. Hanu watches what the build actually did, not what the pipeline file says it should do.

CI/CD security platformworkflow tampering detectionsoftware supply chain security

What changes

The build system is treated as an untrusted environment: workflow tampering, unpinned actions, provenance gaps, release freshness and certificate lifecycle are all first-class signals with direct evidence.

Workflow tampering is a detection, not a code review

A push that changes the workflow of a repository holding deploy credentials is a signal on its own. Combined with a secret becoming readable, it is a critical chain — the pattern behind the GhostAction campaign across hundreds of repositories.

Provenance gaps only matter next to something else

A release with no provenance is common and mostly benign. It becomes actionable when the same release is fresh, unreviewed, and its dependency is being invoked from a cloud account for the first time. Hanu only escalates the combination.

Certificates and keys are operational objects

Certificate transparency, expiry, weak key material and issuer reputation are tracked as infrastructure inventory, so a public CA losing control of an intermediate is something you can query rather than something you read about.

A reasonable first fortnight

Not a migration plan — the first two weeks, in the order that produces something useful fastest.

Attach the repository list that owns production deploys and run the hygiene scan with includeHygiene on.
Work the unpinned-action findings in the repos that hold deploy credentials first.
Turn on release-freshness and provenance gates for your own packages before your dependencies.
Import your certificate inventory and confirm the issuer list matches the CAs you actually trust.

Questions this role tends to ask

Which CI systems do you actually integrate with?

GitHub, GitLab, CircleCI and Jenkins have live feedback modules — findings are returned as check runs or build steps. Others can send webhooks in. The unpinned-action hygiene check is opt-in (includeHygiene) because it is noisy by nature; it is off for organisation scans and on for the pull-request gate.

How do you decide a release is suspicious?

Release freshness gates: 72 hours for your own packages, 24 hours for dependencies. A provenance gap on its own does not escalate — it only contributes when another anomaly is present, which is what keeps the signal usable for a platform team rather than a security team.

What about someone tampering with our workflows?

A workflow file change in a repository holding credentials is a tier-1 signal. When the same workflow later makes a secret readable, tier-2 correlation turns it into a CRITICAL chain with the commit, the workflow path and the secret identifiers attached — the GhostAction pattern across hundreds of repositories.

Can we query our own certificate inventory?

Yes. Certificate transparency, expiry, key strength and issuer reputation are tracked as infrastructure inventory. When a public CA loses control of an intermediate, you can ask which of your certificates were issued through that hierarchy rather than waiting for a vendor notice.

What it is not

Hanu is not a SIEM and does not try to be one — it correlates and hands the result to the response process you already run. It is not a certified SOC 2 Type II service for self-hosted customers; the evidence engines and audit trail support your own controls. And it does not cover Oracle Cloud, which exists in the codebase as stubs only.

Run it in your own account

One Docker Compose stack, your datastores, read-only credentials into your clouds. The Community edition is free to run in production.

Deploy Hanu See what is paid