Show HN: Proactive Security Monitoring for GitHub Actions Workflows
Why we built this:
As friends and collaborators for over a decade, we've been working on various startup ideas in dev tools and infrastructure. In 2017, while building an ML ops toolkit on Kubernetes, we got hacked. During a pilot with a fintech customer, our cluster became victim to a crypto-jacking attack.
As it turned out, a dependency in our container base image contained malware (a Monero miner) which triggered inside the customer's environment. Needless to say, we lost the customer and racked up a massive cloud bill as a tiny startup. This first-hand experience introduced us to one of the biggest challenges in software security today.
The Problem:
Modern engineering teams rely heavily on 3rd parties—from open source packages, base images and 3rd-party tooling to build & deploy software quickly. But this creates security blind spots exploited in modern supply chain attacks. Some high-profile cases targeting developer environments include:
(1) event-stream: a malicious transitive dependency injected a wallet-drainer payload into the build process for CoPay’s bitcoin wallet (2) SolarWinds: a compromised build tool injected malicious code into downstream releases (3) Codecov: a bash uploader script inside the testing tool stole secrets when run in CI
While most teams today incorporate some form of security scanning, it typically focuses on known vulnerabilities. In contrast, we detect zero-day threats and harden your build & release processes against malicious activity. With a focus on developer experience.
Enter listen.dev: a tool to analyze the behavior of your GitHub Actions workflows. How it works:
- Native integration via a simple workflow step. You can instrument your build, test, and release processes in any language or stack. - Observes low-level behaviors using eBPF (network, file, process signals) over each run - Detects anomalies and malicious activity using threat intelligence and out-of-the-box detections for known bads (e.g., info stealers making unknown network connections, reverse shells, tampering of builds etc.) - Offers in-line PR feedback with context, plugging into existing toolchains via webhooks
Behind listen.dev is a team of builders and OSS maintainers with years of experience in security observability and developer tools—having previously worked on eBPF runtime security projects like Falco and Tracee. We're seeking feedback from DevOps and security folks to help us improve.
You can sign up for free at https://lstn.dev/hn, install our GitHub action in under a minute, and start monitoring your repos.
We'd love to hear from you–any feedback and questions are welcome. To learn more see https://docs.listen.dev and a video of how it works: https://lstn.dev/demo-video