[security-observability] Daily Security Observability Report — 2026-11-10

[github-actions[bot]]

Executive Summary

This report is partial coverage, not a full seven-day census. Startup found 84 eligible completed runs and capped the audit at 20 (newest first). All 20 audits succeeded (0 failed, 0 budget-stopped, 64 omitted). The sample comes from 2026-11-10 only. 14 of the 20 runs are from the firewall dataset and 6 are from the DIFC dataset.

Firewall: The 20 audited runs made 856 network requests. 855 were allowed and 1 was blocked, a 0.12% block rate. The only block was an unattributed (unknown) destination in Daily Fact. All allowed traffic went to expected infrastructure: Copilot/GitHub APIs, OpenAI, Sentry and Grafana telemetry, and Go and GCS package hosts. No policy rule-level denials were recorded.

DIFC: The 6 DIFC-dataset runs produced 74 filtered events, all on 2026-11-10 and all from the github MCP server. 73 events (98.6%) were integrity filters, where the agent cannot read data below the "approved" integrity level. 1 event was a secrecy filter. search_issues alone caused 60 events (81%). Daily Documentation Updater was the largest source (44 events).

Cross-cutting: No workflow had a firewall block and DIFC filtering in the same run, except that Daily Fact has both. It had the only firewall block (1) and 11 DIFC events. The two signals are otherwise independent. Network egress is clean, and the filtering activity is read-time integrity filtering on public, unapproved GitHub content.

---

🔥 Firewall Analysis

Key Firewall Metrics

Metric	Value
Workflows analyzed (firewall-enabled)	20 runs audited (14 workflows)
Total network requests monitored	856
✅ Allowed requests	855
🚫 Blocked requests	1
Block rate	0.12%
Total unique blocked domains	0 named (1 unattributed (unknown) block)

Coverage: 20 selected, 20 audited, 0 failed, 64 omitted by the audit cap (84 eligible). This is partial coverage.

📈 Firewall Request Trends

The bounded audit sample covers only 2026-11-10, so a 30-day time series isn't possible. The chart shows per-run allowed vs. blocked volume instead. Request volume is steady, at roughly 20–110 requests per run. The heaviest are the Matt Pocock Skills Reviewer runs (90 and 109). The single block appears in Daily Fact (run 42831945709).

Top Blocked Domains

With only one block, the chart shows the top domains by total request volume (log scale, blocked in red). The firewall did not attribute the lone block to a hostname. That pattern is usually a non-HTTP(S) or malformed request, or a connection that never completed a CONNECT/SNI handshake.

Most Frequently Blocked Domains

Domain	Times Blocked	Workflows	Category
(unknown)	1	Daily Fact	Unattributed

Policy Rule Attribution

📋 Policy: 9–11 rules, SSL Bump disabled, DLP disabled (varies by workflow).

policy_analysis.rule_hits was empty in all 20 audits, and denied_count was 0. No rule-level attribution is available this period.

View Detailed Request Patterns by Workflow

Workflow	Runs	Allowed	Blocked
Matt Pocock Skills Reviewer	2	199	0
PR Code Quality Reviewer	2	97	0
Daily Documentation Updater	1	76	0
Ponytail Reviewer	2	64	0
Go Fan	1	59	0
PR Specification Reviewer	2	55	0
GitHub MCP Structural Analysis	1	46	0
Daily SPDD Spec Planner	1	44	0
Test Quality Sentinel	2	43	0
Design Decision Gate 🏗️	2	40	0
PR Sous Chef	1	37	0
Daily CLI Performance Agent	1	35	0
Code Scanning Fixer	1	31	0
Daily Fact	1	29	1

View Allowed Domain Volumes (all domains observed)

Domain	Allowed	Blocked
api.githubcopilot.com:443	314	0
otlp-gateway-prod-eu-west-2.grafana.net:443	182	0
o205451.ingest.us.sentry.io:443	182	0
api.github.com:443	140	0
api.openai.com:443	12	0
proxy.golang.org (:443 and bare)	16	0
github.com:443	3	0
storage.googleapis.com (:443 and bare)	4	0
sum.golang.org (:443 and bare)	2	0
(unknown)	0	1

🔒 Firewall Security Recommendations

1. Investigate the (unknown) block in Daily Fact run 42831945709. Check the raw squid/AWF logs for the request that carried no hostname, and confirm it isn't a legitimate tool needing an allowlist entry.
2. No allowlist expansion is needed. There are no recurring blocked hostnames.
3. Rule attribution is empty. Confirm the audit's policy_analysis is correctly populated from the firewall logs. All 20 runs reported 0 rule hits despite 856 requests.
4. Raise the audit cap or add a second page if a true weekly census is wanted. Today's sample covers 24% of eligible runs.

---

🔒 DIFC Integrity Analysis

Key DIFC Metrics

Metric	Value
Total filtered events	74
Unique tools filtered	6
Unique workflows affected	6
Most common filter reason	Integrity (73 of 74; below "approved")
Busiest day	2026-11-10 (74 events)

The restored warm-start snapshot (updated_at 2026-11-10T16:04:30Z) is valid. The DIFC dataset lists 200 runs from the last ~18 days, 70 of them from the last 7 days. Only the 6 runs that overlap the bounded audit sample were audited for event detail.

📈 DIFC Events Over Time

All audited events fall on 2026-11-10, because the cap selects the newest runs. The chart shows hourly distribution (UTC). Daily trends can't be inferred from this sample.

🔧 Top Filtered Tools

search_issues dominates with 60 events (81%). Agents running cross-repo or broad issue searches return results authored by non-members, which are tagged none:public or unapproved:public. Next are get_discussion_comments (10) and single events each for get_discussion, get_code_scanning_alert, list_code_scanning_alerts and list_issues.

🏷️ Filter Reasons and Tags

Integrity filtering accounts for 73 events and secrecy for 1. The integrity tags are none:public (74), unapproved:public (63) and approved:public (1). The two private secrecy tags appear on list_code_scanning_alerts and get_code_scanning_alert. The agent doesn't hold private-scope authorization in those runs.

📋 Per-Workflow DIFC Breakdown

Workflow	Filtered Events
Daily Documentation Updater	44
Daily Fact	11
Daily CLI Performance Agent	10
Go Fan	5
GitHub MCP Structural Analysis	3
Code Scanning Fixer	1

📋 Per-Server DIFC Breakdown

MCP Server	Filtered Events
github	74

👤 Per-User DIFC Breakdown

The audit output (mcp_tool_usage.filtered_events) did not include author_login or author_association, so a per-user breakdown is unavailable. Each event instead carries a resource reference (issue:owner/repo#N, discussion:..., security-alert:...) and an html_url.

💡 DIFC Tuning Recommendations

1. Review search_issues usage in Daily Documentation Updater (44 events). Scope queries with author_association-friendly filters (for example repo:github/gh-aw plus is:issue label:...), or prefetch the relevant data in a pre-agent step.
2. Decide whether the approved integrity floor is intended for the read-only reporting workflows (Daily Fact, Daily CLI Performance Agent, Go Fan). If they must read community-authored content, evaluate lowering min-integrity per workflow. Otherwise accept that the filtered content is excluded by design.
3. Check get_discussion / get_discussion_comments in Daily Fact (11 events). One event reports discussion:github/gh-aw#unknown, which suggests a resource-labeling gap worth reporting upstream.
4. Code-scanning tools (Code Scanning Fixer, GitHub MCP Structural Analysis) hit private-scope secrecy and unapproved-integrity filters. If those workflows need alert data, add the required authorization. Otherwise remove the tools from the toolset.
5. Add author fields to audit output. Without author_login and author_association on filtered events, per-user tuning isn't possible.

---

Generated by the Daily Security Observability workflow (consolidated from Daily Firewall Reporter + Daily DIFC Analyzer)
Analysis window: Last 7 days (bounded sample: 20 of 84 eligible runs) | Repository: github/gh-aw
Run: https://github.com/github/gh-aw/actions/runs/42849033654

Generated by 🔒 Daily Security Observability Report · copilot · routed: sonnet55 high · ~42 AIC · ⌖ ~2 AIC · ⊞ 12.3K · ◷

• expires on Nov 13, 2026, 8:13 AM UTC-08:00