defuse Workspace
Containment console
incidents / scenario-sandbox
verified

Scenario: self-replicating loader in @defuse-sandbox

defuse-sandbox

Local scenario · modeled services and simulated timings.

3m 00s
Time to containment
detected → last action
4
Secrets exposed
see the ledger for rotation status
1
Rogue versions
republished without provenance
2
CI jobs infected
2 generations deep

Timeline

replay
  1. Incident opened

    incident.opened

  2. Exposure found

    found 2 package version(s)

  3. Exposure found

    found 2 job(s)

  4. Exposure found

    found 2 runner(s)

  5. Exposure found

    found 1 host(s)

  6. Exposure found

    found 4 secret(s)

  7. Exposure found

    found 1 registry package(s)

  8. Exposure found

    found 1 hook file(s)

  9. Exposure found

    found 1 agent session(s)

  10. Exposure found

    found 1 watcher(s)

  11. Plan ready

    22 actions in 6 layers; replay safe=True

  12. Containment started

    containment.started

  13. Action

    isolate_host host:defuse-runner-1: applied

  14. Action

    pause_runner runner:7: applied

  15. Action

    quarantine_version pkg:@defuse-sandbox/strings@2.4.1: applied

  16. Action

    block_agent_identity agent:duo-developer-flow:102: applied

  17. Action

    rotate_secret secret:project_access_token:project/102:42: applied

  18. Action

    snapshot_evidence host:defuse-runner-1: applied

  19. Action

    rotate_secret secret:deploy_token:project/103:31: applied

  20. Action

    revoke_secret secret:project_access_token:project/102:42: applied

  21. Action

    rotate_secret secret:ci_variable:group/defuse-sandbox:SENTRY_AUTH_TOKEN: applied

  22. Action

    rotate_secret secret:project_access_token:project/102:41: applied

  23. Action

    pin_known_good project:101: applied

  24. Action

    pin_known_good project:102: applied

  25. Action

    stop_watcher watcher:defuse-runner-1:defuse-watcher.service: applied

  26. Action

    revoke_secret secret:deploy_token:project/103:31: applied

  27. Action

    revoke_secret secret:project_access_token:project/102:41: applied

  28. Action

    rebuild_artifacts project:101: applied

  29. Action

    rebuild_artifacts project:102: applied

  30. Action

    remove_persistence host:defuse-runner-1: applied

  31. Action

    remove_hook_files project:102: applied

  32. Action

    rebuild_artifacts project:103: applied

  33. Action

    verify_clean incident: applied

  34. Action

    restore_agent_identity agent:duo-developer-flow:102: applied

  35. Verification checked

    verification passed

Every action. In the right order.defuse