[security-observability] Daily Security Observability Report — 2026-09-11

[github-actions[bot]]

Executive Summary

Over the analysis window, the firewall processed 1,172,643 network requests across 100 firewall-enabled workflow runs (50 unique workflows), blocking 1,168,380 requests (99.64%). This extreme block rate is almost entirely driven by a single event: one Impeccable Skills Reviewer run generated 1,168,196 blocked requests to registry.npmjs.org, most likely a dependency-resolution loop or retry storm rather than malicious traffic. Outside that anomaly, firewall activity is light and unremarkable — 8 unique domains were blocked in total, dominated by expected package-registry and AI-provider endpoints.

On the DIFC integrity side, 2,785 filtered events were observed across 54 of 57 analyzed runs spanning 24 unique workflows. The dominant driver (99.7% of events) is agents attempting to read unapproved/public GitHub issues — content below the integrity threshold required by the calling workflow — concentrated in list_issues and search_issues calls against the github MCP server. Daily Assign Issue To User and Dev account for over 40% of all filtered events, suggesting these workflows routinely enumerate broad issue sets that include untrusted, unapproved content by design (and are being correctly filtered, not mis-configured).

No workflow appears in both the firewall-block hot list and the DIFC top-filtered list, indicating the two control planes are catching different, largely independent risk classes: network egress anomalies (firewall) versus content-trust boundary violations (DIFC).

---

🔥 Firewall Analysis

Key Firewall Metrics

Metric	Value
Workflows analyzed (firewall-enabled)	100 runs / 50 unique workflows
Total network requests monitored	1,172,643
✅ Allowed requests	4,263
🚫 Blocked requests	1,168,380
Block rate	99.64%
Total unique blocked domains	8

📈 Firewall Request Trends

The log-scale trend makes clear that blocked volume is dominated by a single-day spike, driven almost entirely by one run's repeated npm registry requests. Excluding that anomaly, allowed and blocked traffic both track normal levels (low hundreds to low thousands of requests), consistent with routine MCP tool and package-manager use across workflows.

Top Blocked Domains

registry.npmjs.org overwhelmingly dominates blocked volume due to one anomalous run; all other blocked domains are low-frequency and consistent with expected package-manager (Go), AI-provider, and GitHub-infra traffic hitting egress rules rather than malicious destinations.

Most Frequently Blocked Domains

Domain	Times Blocked	Workflows	Category
registry.npmjs.org:443	1,168,205	Impeccable Skills Reviewer, Repository Quality Improvement Agent	Package registry (npm)
proxy.golang.org:443	133	CI Optimization Coach	Package registry (Go)
(unknown)	16	Agent Persona Explorer, Architecture Guardian, Breaking Change Checker...	Unresolved/DNS
github.com:443	11	Agentic Workflow AIC Usage Optimizer, Daily Malicious Code Scan Agent, Matt Pocock Skills Reviewer...	GitHub infra
ab.chatgpt.com:443	10	Agent Persona Explorer, Daily CLI Performance Agent, Issue Triage Agent...	AI provider API
api.anthropic.com:443	2	Claude Code User Documentation Review, GitHub MCP Structural Analysis	AI provider API
api.github.com:443	2	Agentic Workflow AIC Usage Optimizer	GitHub infra
storage.googleapis.com:443	1	Delight	Cloud storage

Policy Rule Attribution

📋 Policy: 11 rules (most runs), SSL Bump disabled, DLP disabled — a small number of runs reported 9–10 rules, indicating minor policy-version drift across recent workflow runs.

No rule-level hit counts were returned by the audit tool for these runs (rule_hits was empty in all responses), so per-rule attribution could not be computed this cycle.

View Detailed Request Patterns by Workflow

Workflow	Allowed	Blocked	Runs
Impeccable Skills Reviewer	120	1,168,196	5
CI Optimization Coach	166	134	1
Repository Quality Improvement Agent	217	10	1
Matt Pocock Skills Reviewer	659	5	5
Ponytail Reviewer	110	5	5
Test Quality Sentinel	268	3	5
Daily Malicious Code Scan Agent	166	3	1
Agentic Workflow AIC Usage Optimizer	86	3	1
Workflow Normalizer	12	2	1
GitHub MCP Structural Analysis	72	2	1
Daily CLI Performance Agent	14	2	1
Issue Triage Agent	11	2	1
PureLock	10	2	1
Agent Persona Explorer	16	2	1
Delight	165	1	1

Remaining ~35 workflows had 0 blocked requests in the analyzed window.

View Complete Blocked Domains List

(unknown), ab.chatgpt.com:443, api.anthropic.com:443, api.github.com:443, github.com:443, proxy.golang.org:443, registry.npmjs.org:443, storage.googleapis.com:443

🔒 Firewall Security Recommendations

1. Investigate the Impeccable Skills Reviewer npm spike. Over 1.16M blocked requests to registry.npmjs.org from 5 runs of one workflow strongly suggests a retry loop, misconfigured npm install/npm ci step, or an unbounded dependency-resolution loop rather than intentional scanning — review that workflow's package-manager invocation and add retry/backoff limits or allowlist the registry if the traffic is legitimate but blocked by policy.
2. Allowlist registry.npmjs.org and proxy.golang.org for workflows that legitimately need package installation, to avoid noisy false-positive blocks obscuring real anomalies in firewall logs.
3. Resolve the (unknown) domain blocks (16 occurrences across 3+ workflows) — these typically indicate DNS resolution failures or SNI mismatches; investigate whether they represent misconfigured proxy rules.
4. Audit ab.chatgpt.com blocks across Agent Persona Explorer, Daily CLI Performance Agent, and Issue Triage Agent — confirm these are intentional blocks of an unapproved AI provider rather than workflows that need it allowlisted.
5. Standardize the firewall policy rule count (9 vs 10 vs 11 rules seen across runs) to eliminate policy drift between workflow runs.

---

🔒 DIFC Integrity Analysis

Key DIFC Metrics

Metric	Value
Total filtered events	2,785
Unique tools filtered	9
Unique workflows affected	24
Most common filter reason	integrity: insufficient resource integrity (2,776 events, 99.7%)
Busiest day	2026-09-08 (751 events)

📈 DIFC Events Over Time

Filtering activity is bursty rather than steady, with three clear peaks (Sep 5, Sep 8, Sep 11) each exceeding 690 events, separated by low-activity days (Sep 2, Sep 3, Sep 7). These peaks align with scheduled runs of high-volume issue-scanning workflows rather than indicating an escalating trend.

🔧 Top Filtered Tools

list_issues (1,508) and search_issues (1,240) together account for 98.7% of all filtered events — both are broad enumeration calls against the GitHub MCP server that naturally surface a mix of approved and unapproved content, so filtering here is expected behavior rather than a sign of misconfiguration. All other tools (search_repositories, list_pull_requests, get_file_contents, issue_read, get_code_scanning_alert, search_code, list_dependabot_alerts) are filtered rarely (≤12 events each).

🏷️ Filter Reasons and Tags

99.7% of filtered events are integrity-based (insufficient resource integrity vs. required threshold); only 9 events (0.3%) were secrecy-based. Tag-wise, unapproved:public (2,025) and none:public (2,785, applied to all events) dominate, with only 23 events tagged approved:public (filtered for other reasons) and 69 events carrying the private secrecy tag — confirming the filter is almost exclusively enforcing the "no unapproved public content" integrity boundary.

📋 Per-Workflow DIFC Breakdown

Workflow	Filtered Events
Daily Assign Issue To User	669
Dev	511
Sub-Issue Closer	274
Smoke Agent: public/approved	233
Workflow Normalizer	209
Deep Report	208
Daily AW Cross-Repo Compile Check	107
Dependabot Dependency Checker	100
Agent Performance Analyzer - Meta-Orchestrator	90
Smoke Temporary ID	77
Daily Container Image Security Scan	65
Static Analysis Report	59
Daily Compiler Threat Spec Optimizer	30
GitHub Remote MCP Authentication Test	29
Issue Triage Agent	28
Daily Documentation Healer	28
Smoke Agent: all/merged	26
Auto-Triage Issues	15
Daily Regression Audit	7
Smoke Agent: scoped/approved	6
GitHub MCP Structural Analysis	5
Daily Spec Coverage Review	5
Code Scanning Fixer	3
Daily Evals Feature Report	1

📋 Per-Server DIFC Breakdown

MCP Server	Filtered Events
github	2,785

👤 Per-User DIFC Breakdown

Author Login	Filtered Events
(unknown/automation)	2,535
lpcox	24
yskopets	22
dsyme	13
v1v	10
JamesNK	10
bbonafed	10
benissimo	7
loganrosen	6
theletterf	6
praveenkuttappan	5
lfgcampos	5
MH0386	5
mvdbos	5
arezero	5
TiggySravan	5
bindsi	5
johnpreed	5
chepa92	5
danielmeppiel	5

(Full list of 57 distinct contributors available in raw event data; long tail of 1–4 events each omitted for brevity.)

💡 DIFC Tuning Recommendations

1. Treat list_issues/search_issues filtering on Daily Assign Issue To User, Dev, and Sub-Issue Closer as expected, not anomalous — these workflows intentionally enumerate broad issue sets, and 99%+ of filters are correctly blocking unapproved/public content from being read. No tuning action needed unless task completion is being materially impacted.
2. If Daily Assign Issue To User (669 events, top workflow) is failing to find eligible issues, consider narrowing its search query (e.g., adding label/state filters) to reduce noise and MCP call volume rather than loosening the integrity threshold.
3. Investigate the 69 private secrecy-tagged filters — confirm no workflow is inadvertently attempting to read private repository content it shouldn't have visibility into; these are low-volume but worth a manual spot-check.
4. No evidence of authorization escalation attempts — filtered events are concentrated in read-only enumeration tools, and no single external contributor triggers a disproportionate share (top named user is 24/2,785 ≈ 0.9%), so no per-user tightening is currently warranted.
5. Correlate the Sep 5/8/11 activity peaks with schedule configuration — if these are recurring daily/weekly cron runs of the top workflows, the bursty pattern is expected; if unplanned, review trigger conditions for accidental duplicate runs.

---

Generated by the Daily Security Observability workflow (consolidated from Daily Firewall Reporter + Daily DIFC Analyzer)
Analysis window: Last 7 days | Repository: github/gh-aw
Run: https://github.com/github/gh-aw/actions/runs/34618737701

Generated by 🔒 Daily Security Observability Report · copilot · auto · 177.2 AIC · ⌖ 9.67 AIC · ⊞ 15.5K · ◷

• expires on Sep 14, 2026, 8:44 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-14T16:44:19.965Z.

Closed by Workflow