[security-observability] Daily Security Observability Report — 2026-08-29

[github-actions[bot]]

Executive Summary

This report covers a sample of 47 firewall-enabled workflow runs (drawn representatively from 100 total firewall-enabled runs observed on 2026-08-29 — no runs from the preceding 6 days were found in the pre-collected dataset, so trend data reflects a single-day snapshot rather than a full 7-day trend). Across these runs, 448 of 3,086 total network requests (14.5%) were blocked by the firewall, dominated by GitHub API/web domains (api.github.com, github.com, raw.githubusercontent.com) and AI-assistant domains (chatgpt.com, ab.chatgpt.com). Two workflows — PureLock and Dead Code Removal Agent — accounted for the large majority of blocked traffic (225 and 158 blocked requests respectively), suggesting their network allowlists may need tuning rather than indicating malicious activity.

No DIFC integrity-filtered events were found in the last 7 days — the integrity/secrecy filtering gateway had zero flagged tool calls, indicating no risky cross-boundary tool invocations were detected in this window.

There is no cross-cutting overlap between the firewall-blocking workflows and any DIFC-filtered workflow, since the DIFC dataset is empty.

---

🔥 Firewall Analysis

Key Firewall Metrics

Metric	Value
Workflows analyzed (firewall-enabled, sampled)	47 (out of 100 firewall-enabled runs in window)
Total network requests monitored	3,086
✅ Allowed requests	2,638
🚫 Blocked requests	448
Block rate	14.5%
Total unique blocked domains	83

📈 Firewall Request Trends

All 47 sampled runs occurred on 2026-08-29, so this chart shows a single-day aggregate rather than a 7-day trend (no earlier firewall-enabled runs were present in the pre-collected dataset). Allowed requests (2,638) substantially outnumber blocked requests (448), a healthy ~6:1 ratio, though a handful of workflows generated disproportionately high block counts.

Top Blocked Domains

api.github.com:443 (196 blocks) and github.com:443 (99 blocks) are by far the most frequently blocked domains — these are legitimate GitHub endpoints being blocked likely due to workflows lacking proper github network permission scoping, not malicious traffic. raw.githubusercontent.com:443 (50 blocks) shows a similar pattern. AI-assistant domains chatgpt.com and ab.chatgpt.com (24 + 11 blocks) suggest some workflows are attempting to reach ChatGPT endpoints without an allowlisted engine permission.

Most Frequently Blocked Domains

Domain	Times Blocked	Workflows	Category
api.github.com:443	196	Ponytail Reviewer, Dead Code Removal Agent, PureLock	GitHub API
github.com:443	99	Ponytail Reviewer, Dead Code Removal Agent, PureLock	GitHub Web
raw.githubusercontent.com:443	50	Dead Code Removal Agent, PureLock	GitHub Content
chatgpt.com:443	24	Ponytail Reviewer, Issue Monster, Daily Max Ai Credits Test	AI Assistant
ab.chatgpt.com:443	11	Ponytail Reviewer, Issue Monster, Daily Credit Limit Test	AI Assistant
api.anthropic.com:443	11	Developer Documentation Consolidator, Claude Code User Documentation Review, Deep Report	AI Provider
proxy.golang.org:443	5	Daily Formal Spec Verifier	Package Registry
storage.googleapis.com:443	2	Delight	Cloud Storage
*.grafana.net	2	Dead Code Removal Agent	Observability
*.sentry.io	2	Dead Code Removal Agent	Observability
api.github.com (no port)	2	Dead Code Removal Agent	GitHub API
api.npms.io	2	Dead Code Removal Agent	Package Registry
api.snapcraft.io	2	Dead Code Removal Agent	Package Registry
archive.ubuntu.com	2	Dead Code Removal Agent	OS Package Mirror
awmg-cli-proxy	2	Dead Code Removal Agent	Internal Proxy
awmg-mcpg	2	Dead Code Removal Agent	Internal Gateway
azure.archive.ubuntu.com	2	Dead Code Removal Agent	OS Package Mirror
bun.sh	2	Dead Code Removal Agent	Package Registry
cdn.jsdelivr.net	2	Dead Code Removal Agent	CDN

Policy Rule Attribution

📋 Policy: 11 rules, SSL Bump disabled, DLP disabled (consistent across all sampled runs)

Detailed per-rule hit/deny counts were not exposed in the individual policy_analysis.rule_hits fields for these runs — only the aggregate policy summary was consistently reported.

View Detailed Request Patterns by Workflow

Workflow	Runs Sampled	Total Requests	Allowed	Blocked
PureLock	1	428	203	225
Dead Code Removal Agent	1	313	155	158
Daily Max Ai Credits Test	1	45	28	17
Ponytail Reviewer	2	83	72	11
Issue Monster	2	42	32	10
Daily Credit Limit Test	1	26	20	6
Daily Formal Spec Verifier	1	163	159	4
Agent Performance Analyzer - Meta-Orchestrator	1	131	128	3
Developer Documentation Consolidator	1	190	188	2
Claude Code User Documentation Review	1	192	190	2
Deep Report	1	100	98	2
Daily Malicious Code Scan Agent	1	66	64	2
Delight	1	64	63	1
Workflow Normalizer	1	96	95	1
PR Sous Chef	2	71	70	1
Constraint Solving — Problem of the Day	1	23	22	1
[aw] Failure Investigator (6h)	1	21	20	1
Daily Go Test Parallelizer	1	41	40	1

Remaining sampled workflows recorded zero blocked requests.

View Complete Blocked Domains List

*.grafana.net, *.sentry.io, ab.chatgpt.com:443, api.anthropic.com:443, api.github.com, api.github.com:443, api.npms.io, api.snapcraft.io, archive.ubuntu.com, awmg-cli-proxy, awmg-mcpg, azure.archive.ubuntu.com, bun.sh, cdn.jsdelivr.net, chatgpt.com:443, github.com:443, proxy.golang.org:443, raw.githubusercontent.com:443, storage.googleapis.com:443, and ~64 additional lower-frequency domains observed once each (full raw domain list available in the audit tool output per run; truncated here for length — 83 unique blocked domains total).

🔒 Firewall Security Recommendations

1. Review PureLock and Dead Code Removal Agent's network permissions — these two workflows generated 383 of the 448 total blocked requests (85%). If these are legitimate needs (e.g., fetching from api.github.com, raw.githubusercontent.com), add explicit network allowlist entries rather than leaving them blocked repeatedly.
2. Investigate ChatGPT-domain traffic (chatgpt.com, ab.chatgpt.com — 35 combined blocks across Ponytail Reviewer, Issue Monster, Daily Max Ai Credits Test, Daily Credit Limit Test) — confirm whether these are expected engine calls that need allowlisting or unintended/leftover configuration.
3. No newly suspicious or unexpected external domains were observed among top blocked entries — all are recognizable developer tooling, package registries, or AI-provider endpoints, indicating the firewall is functioning as intended rather than surfacing exfiltration attempts.
4. Expand the audit sample to the full 100 firewall-enabled runs in a future run, since transient context deadline exceeded errors from the audit tool prevented full coverage this cycle (47/49 targeted sample runs succeeded after retries; one run — #33261440641 — was still in_progress at analysis time).

---

🔒 DIFC Integrity Analysis

No DIFC integrity-filtered events found in the last 7 days. /tmp/gh-aw/agent/integrity/filtered-logs.json returned an empty runs array, and the restored cache snapshot (updated_at: 2026-08-29T16:06:21Z) confirms this is a fresh, valid empty result rather than stale data. No tool calls were blocked by the Data Integrity and Flow Control system in this window — no charts, tuning recommendations, or per-workflow/per-server/per-user breakdowns are applicable.

---

Generated by the Daily Security Observability workflow (consolidated from Daily Firewall Reporter + Daily DIFC Analyzer)
Analysis window: Last 7 days | Repository: github/gh-aw
Run: https://github.com/github/gh-aw/actions/runs/33261440641

Generated by 🔒 Daily Security Observability Report · copilot · auto · 105.5 AIC · ⌖ 10.6 AIC · ⊞ 15.4K · ◷

• expires on Sep 1, 2026, 8:37 AM UTC-08:00