Worm containment for GitLab CI

Contain the supply-chain worm.
Keep your world intact.

From the first exposure to the final verification.
Every action, in the one order that keeps you safe.

Explore your workspace Watch the replay
Latest incidentVerified
Local modeled scenario
Built around the safe order
IsolatePreserveVerify
6 constraints. Every plan.
Clarity in the middle of an incident.↓
Your engine. A clearer picture.

Complex threats.
One safe order.

See what is exposed, understand the plan,
and follow every action through to verification.

Incidents in your workspace1From the connected engine
CI jobs exposed2Latest incident’s exposure graph
Actions executed22Latest incident’s action ledger
Time to containment3m 00sModeled scenario timing
GitLab CIExposure graphSafe-order plannerVerified evidence
A little clarity goes a long way

From exposure.
To peace of mind.

One connected workflow. A reason behind every move.

See the whole picture.

Trace affected CI jobs to runners, credential scopes, rogue packages, and planted agent hooks. Metadata only. Secret values stay private.

Explore the map
Connected to the engine

Your containment workspace.

The full picture, from first signal to verified outcome.

Metadata only. Secret values are never collected.Local scenarios use modeled services and timings.

A few things worth knowing

Confidence comes
from understanding.

Containment should be explainable.
Right down to the next action.

Why does the order matter?

A worm can watch for credential revocation and trigger a destructive handler. Defuse isolates the host or stops its watcher first, preserves evidence, then removes persistence and rotates credentials in the safe order.

Does Defuse read my secrets?

No. Collectors request variable names, scopes, and metadata only. Credential replacement is handled by a separate authority. Secret values are never collected, displayed, or logged by the containment engine.

What can I see in the console?

Each incident has a live event timeline, an interactive exposure map, an ordered action plan with safety explanations, a naive-versus-Defuse replay, and an action ledger with verification evidence.

Is the local scenario live containment?

The seeded scenario uses inert modeled services and simulated incident timings. It demonstrates the complete workflow, but does not establish real GitLab or cloud containment. The console labels scenario data explicitly.

Every action, in the right order

Keep the threat contained.
Keep your world intact.

Your exposure. Your plan. The evidence to trust it.

Open your workspace