Security Global Overview

One live trust break needs containment, two concentration hotspots widen company consequence, and two blind spots are still slowing confident response.

This page is the first-contact view for security. It should say what matters now, where risk is clustering, what changed since the last scan, and which drill path reduces uncertainty fastest.

Operator Brief

Needs review

2 urgent concerns · 3 hotspots · 2 trust gaps · 1 fastest containment path

Posture

Needs review

Two urgent stories are active and confidence is limited by unresolved attribution.

Critical Concerns

2 now

One live trust break and one boundary-crossing story need fast investigation.

Hotspots

3 lanes

Credential reuse, auth-service touchpoints, and outbound boundary edges are carrying most of the consequence.

Trust Gaps

2 gaps

Endpoint ownership and destination intent still weaken response confidence.

What Matters Now

Every elevated card needs explanation, scope, and one obvious next click.

urgentstill live

confidence: medium-high

Unknown credential remains active inside a live coding session.

This is the fastest path from uncertainty to company consequence because the key is unresolved, the session is still live, and the touched code sits near auth-service paths.

Why It Matters

Shared credential lanes can widen impact quickly when they remain active inside a session that has already touched important company context.

Affected Scope

API key lane, auth-service file cluster, one unresolved host, and any downstream systems that trust this key path.

Fastest Action

Verify or suspend the key first, then inspect the live session for additional sensitive reach.

Evidence bundle: sk-ant-...C001 · active session · auth.ts · unresolved endpoint

Open security board

warningboundary crossed

confidence: medium

Sensitive code touch is now paired with a plain HTTP edge.

The concern is the relationship, not the isolated events. A session touched auth-related code and then crossed into an unencrypted destination lane.

Why It Matters

Boundary crossings matter most when they follow access to sensitive files, repos, or shared execution paths.

Affected Scope

auth-service, one outbound host, one active session window, and possible secret or code-context exposure.

Fastest Action

Classify the destination and verify whether sensitive content could have crossed the boundary.

Evidence bundle: /src/auth.ts · 10.0.2.15:8080 · http · same session window

Open inventory board

reviewblast radius widening

confidence: medium

One shared automation lane is touching more high-consequence surfaces.

The issue may be legitimate growth, but concentration matters when one automation path starts to span sensitive repos, hosts, and credential lanes.

Why It Matters

Shared execution paths can turn a local trust decision into an organization-wide blast-radius problem.

Affected Scope

auth-service, customer-web, one automation identity, and two environments now tied to the same lane.

Fastest Action

Confirm ownership and decide whether this path should be split into narrower credentials or environments.

Evidence bundle: shared automation identity · repo overlap · endpoint spread

Open alerting board

Where Risk Lives

Concentration should feel like hotspot reading, not inventory browsing.

Credential lane

Most immediate risk is still concentrated in one unknown API key lane.

risk

Why Clustered

One credential now connects live activity, sensitive code touchpoints, and uncertain ownership.

Next Drill

Open inventory board

Auth-service context

A small cluster of files and repos carries most of the company consequence.

warning

Why Clustered

The riskiest story is not broad volume; it is adjacency to auth-service and customer-web touchpoints.

Next Drill

Open security board

Boundary edge

One low-volume outbound path changed the meaning of the session.

warning

Why Clustered

An unencrypted or unlabeled destination matters because it sits directly after sensitive work.

Next Drill

Open alerting board

What Changed

Only changes that alter trust, scope, or urgency belong here.

A previously unseen API key appeared in a live coding session.

The key surfaced minutes ago, is still active, and has not yet been tied to a known owner or allowlist record.

22m ago

A session crossed from auth-related file access into a plain HTTP destination lane.

Volume stayed low, but consequence rose because the session crossed a boundary after touching sensitive code.

today

A shared automation path now spans more sensitive repos and hosts than before.

This may be legitimate growth, but concentration widened enough to deserve focused review.

today

Trust Gaps

Coverage gaps should explain why confidence is limited.

Endpoint ownership is unresolved

10.0.1.44 still lacks a confident person, team, or environment binding.

Why It Matters

Without owner context, containment and escalation decisions stay slower and less certain than they should be.

What It Unblocks

Host legitimacy, escalation path, and whether the live session is approved company activity.

Destination intent is not labeled

Security can see the plain HTTP edge, but not yet whether the host is expected internal traffic or a true outbound anomaly.

Why It Matters

The relationship is concerning, but response confidence stays lower until boundary intent is classified.

What It Unblocks

Whether the session should be isolated immediately or routed through a lower-cost verification path.

First Drill Paths

Turn next actions into visible destinations, not just prose.

Risky API key

Start with the credential story if the goal is fastest containment.

Open security board

Why Start Here

The unknown key is the cleanest pivot from posture language into a concrete trust decision.

Unresolved endpoint

Start here if the main question is whether this is onboarding drift or shadow activity.

Open settings board

Why Start Here

Host ownership is the biggest attribution blocker in the current picture.

Outbound destination

Start here if the main question is whether sensitive context could have crossed a boundary.

Open alerting board

Why Start Here

The plain HTTP edge is what turns an odd session into a more consequential risk story.

Representative session

Start here if the goal is to inspect the full evidence bundle in one place.

Open inventory board

Why Start Here

The risky session is where credential, host, file, and boundary signals collapse into one story.

Relationship Spotlight

One compact attack-path style story explains more than a long findings table.

Representative Risk Story

Identity uncertainty, sensitive context, and an outbound edge should read like one explainable path.

This is the compact relationship panel for the overview page: enough structure to explain why the risk matters, but small enough that it supports the page instead of becoming the page.

Identity, adjacency, activity, and posture around one representative item.

Identity Chain

Attribution is still weak across the first nodes.

unknown owneridentity gap

10.0.1.44unresolved endpoint

Claude Codeactive coding session

Execution Context

The runtime looks ordinary, which makes the trust break stand out more.

sk-ant-...C001unknown credential

claude-sonnet-4-6expected model lane

active session · 22mstill live

Concern

Unknown key on unresolved host

A live coding session used sk-ant-...C001 from 10.0.1.44, touched auth-service code, and then made a plain HTTP call.

medium confidence · high consequence · active

Sensitive Context

The issue is consequence, not raw volume.

/src/auth.tsauth-service file lane

customer-webadjacent repo reach

shared AI credential laneblast radius

Boundary Edge

The destination shifts the story from odd to concerning.

10.0.2.15:8080destination

httpunencrypted

same session windowadjacent event chain

Trust changed by

unknown key + unresolved host

Consequence increased by

auth-service file touch

Boundary crossed by

plain HTTP destination

Fastest drill

credential story then session evidence

Stable Majority

Normal activity should reassure without competing with live risk.

Known-user sessions

34 / 36

Most current usage still maps cleanly to expected developers or CI runners.

Expected model routing

92%

The bulk of requests stay inside the normal Sonnet and Haiku lane.

Encrypted outbound traffic

7 / 8

Nearly all network edges remain HTTPS and org-familiar.

Resolved Or Stabilizing

Keep visible, but below live concerns and blocked attribution.

New agent type in CI appears contained

The agent remains new, but current behavior still looks bounded to expected CI runners and low-consequence work.

stabilizing

Tooling error spike is no longer spreading

The elevated error rate still exists, but it is no longer adjacent to sensitive sessions or company-critical paths.

monitor