Protocol 3.9DevelopmentSENTINEL · AI-DEGRADED
Secrets Management
Checks for secret scanning tools (gitleaks, truffleHog), native GitHub secret scanning alerts, .gitignore patterns, and security policy. When available, pulls quantitative alert data including open/resolved counts and secret types detected.
One leaked credential can compromise your entire infrastructure. Prevention is 1000x cheaper than remediation.
Velocity Governance · Sentinel-10 Protocol
Protocol 3.9 is one of the 10 engineering practices Concordance flags as most degraded under AI-accelerated development. That 3 publicly-documented incidents in this Index already failed it — before AI was the dominant velocity driver — is exactly the pattern the Velocity Governance thesis predicts will accelerate. Read the thesis →
Incidents that failed this protocol
SolarWindsDec 2020civilizational
SUNBURST malware injected into Orion build pipeline compromises 18,000 organisations
Code-signing key access was not adequately segmented from build infrastructure that could be compromised.
OktaOct 2023enterprise
Okta support-portal HAR file leak exposes 134 customer environments
Secrets management: a production-impacting service-account credential was stored in personal cloud storage rather than a managed secrets vault.
CodecovApr 2021enterprise
Codecov bash-uploader supply-chain compromise exfiltrates customer secrets
Secrets management: customer CI environments executed the script with broad environment-variable access, magnifying blast radius.
See where your repo scores against Protocol 3.9 — and the other 49 — in 60 seconds.
Run a free scan →Full framework →