Tracebit Community Edition installs statistics

Use Tracebit Community Edition and the Community Edition GitHub Action to safely and automatically inject AWS canary credentials (honeytokens) into your build pipelines to detect supply chain attacks. Using Tracebit, you can quickly pinpoint the exact workflow involved in the credential compromise.

Capabilities

• Workflow scanning: Automatically analyses your GitHub Actions workflows to identify where canary credentials (honeytokens) should be deployed. • One-click canary deployment: Triggers a PR to inject the Tracebit Community Action across your workflows. • Continuous coverage monitoring: Tracks which workflows have canaries installed and flags gaps in coverage. • Supply chain attack detection: When a canary credential is used, Tracebit alerts you with full context: repo, workflow, job, commit SHA, and run ID.

Benefits

• Catch supply chain attacks early: Canary credentials act as tripwires. If a compromised dependency, malicious GitHub Action, or poisoned runner exfiltrates secrets, you get an immediate, high-confidence alert. • Cover every exfiltration surface: The action writes canary AWS credentials to ~/.aws/credentials, exports them as environment variables, and holds them in runner process memory, covering credential file sweeps, env var dumps, and /proc/<pid>/mem scraping. • Minimal setup, broad coverage: One organisation secret and a single PR per repo. Tracebit handles credential issuance, rotation, and monitoring. • Pinpoint the exact compromise: Each set of canary credentials is unique per run and tagged with repo, workflow, job, SHA, and run ID, so you know exactly which pipeline run was compromised and when.

Getting Started

Setup Process:

• Register for Tracebit Community Edition to get your API token. • Install the Tracebit GitHub App on your organisation or repositories. • Tracebit scans your workflows and shows you where canaries can be deployed. • Choose your workflows and trigger Tracebit to raise a PR that adds the action in the right place. • Merge the PR. Tracebit continuously monitors your coverage and alerts on any credential use.