[security-observability] Daily Security Observability Report — 2026-09-01

[github-actions[bot]]

Executive Summary

Over the past 7 days, 93 of 100 firewall-enabled workflow runs generated network telemetry, totaling 5,106 monitored requests with a 4.39% block rate (224 blocked / 4,882 allowed). Blocking was concentrated on a small set of domains — most notably proxy.golang.org:443 (136 blocks, entirely from CI Optimization Coach) and ab.chatgpt.com:443 (37 blocks across multiple workflows), suggesting a handful of workflows may need network permission or allowlist updates rather than a widespread security incident.

Separately, the DIFC integrity-filtering layer blocked 354 tool calls across 8 workflow runs, concentrated almost entirely on a single day (Sep 1) and dominated by list_issues (236) and search_issues (111) calls in the Workflow Normalizer and Smoke Agent: public/approved workflows. All filtered events shared the same root cause — the agent attempting to read GitHub issues tagged unapproved:public, which fall below the agent's required integrity threshold. This is expected DIFC behavior protecting against untrusted issue content, not an anomaly.

No workflow appeared in both the top firewall-blocked list and the top DIFC-filtered list, indicating these two protection layers are currently addressing distinct risk surfaces (outbound network egress vs. inbound untrusted GitHub content).

---

🔥 Firewall Analysis

Key Firewall Metrics

Metric	Value
Workflows analyzed (firewall-enabled)	100
Workflows with firewall traffic data	93
Total network requests monitored	5,106
✅ Allowed requests	4,882
🚫 Blocked requests	224
Block rate	4.39%
Total unique blocked domains	6

📈 Firewall Request Trends

All firewall telemetry collected in this window falls on a single reporting day (Sep 1), reflecting the audit tool's per-run created_at granularity rather than an actual traffic spike. Allowed traffic (4,882 requests) vastly outweighs blocked traffic (224), consistent with a healthy baseline where most outbound calls target approved endpoints like api.githubcopilot.com and telemetry backends.

Top Blocked Domains

proxy.golang.org:443 accounts for 61% of all blocked requests, exclusively from CI Optimization Coach — this is likely a Go module proxy dependency that should be allowlisted if the workflow legitimately needs it. ab.chatgpt.com:443 blocks span multiple unrelated workflows (AI Moderator, Daily Credit Limit Test, Feature Grower), suggesting a shared base image or MCP client attempting an unintended outbound call.

Most Frequently Blocked Domains

Domain	Times Blocked	Workflows	Category
proxy.golang.org:443	136	CI Optimization Coach	Package registry
ab.chatgpt.com:443	37	AI Moderator, Daily Credit Limit Test, Feature Grower (+more)	Unknown/telemetry
github.com:443	25	Daily Malicious Code Scan Agent, PR Sous Chef	Version control
api.anthropic.com:443	6	Claude Code User Documentation Review, Deep Report, GitHub MCP Structural Analysis	AI provider API
api.github.com:443	3	Agent Performance Analyzer - Meta-Orchestrator, PR Triage Agent	GitHub API
storage.googleapis.com:443	1	Delight	Cloud storage

[When policy_analysis is available:]

Policy Rule Attribution

📋 Policy: 11 rules, SSL Bump disabled, DLP disabled

No per-rule hit counts were reported by the audit tool for these runs (rule_hits arrays were empty across all sampled runs), so rule-level attribution is not available this cycle.

View Detailed Request Patterns by Workflow (Top 15 by blocked requests)

Workflow	Allowed	Blocked	Total
CI Optimization Coach	80	136	216
PR Sous Chef	724	24	748
Issue Monster	188	12	200
Workflow Normalizer	158	12	170
GitHub API Consumption Report Agent	154	5	159
Daily Go Test Parallelizer	12	4	16
PureLock	125	4	129
Issue Triage Agent	72	4	76
GitHub MCP Structural Analysis	144	2	146
[aw] Failure Investigator (6h)	16	2	18
Agent Performance Analyzer - Meta-Orchestrator	156	2	158
Claude Code User Documentation Review	198	2	200
Daily Credit Limit Test	25	2	27
Daily Malicious Code Scan Agent	38	2	40
Feature Grower	22	1	23

View Complete Blocked Domains List

• ab.chatgpt.com:443
• api.anthropic.com:443
• api.github.com:443
• github.com:443
• proxy.golang.org:443
• storage.googleapis.com:443

🔒 Firewall Security Recommendations

1. Allowlist proxy.golang.org:443 for CI Optimization Coach if the workflow legitimately builds/tests Go modules — this single domain accounts for the majority of all blocks this week.
2. Investigate ab.chatgpt.com:443 across the AI Moderator, Daily Credit Limit Test, and Feature Grower workflows — this domain is not an expected GitHub/Copilot infrastructure endpoint and its recurring appearance across unrelated workflows warrants a source check (e.g., a shared engine/runtime dependency making an unintended telemetry call).
3. Review github.com:443 blocks in Daily Malicious Code Scan Agent and PR Sous Chef — if these workflows need direct git/web access beyond api.github.com, add an explicit allow rule; otherwise this may indicate an unintended redirect or scraping attempt worth auditing.
4. Enable rule-level hit tracking in the firewall policy (currently rule_hits are empty) to support future per-rule attribution and tuning.

---

🔒 DIFC Integrity Analysis

Key DIFC Metrics

Metric	Value
Total filtered events	354
Unique tools filtered	4
Unique workflows affected	8
Most common filter reason	Insufficient integrity level (untrusted/unapproved issue content)
Busiest day	2026-09-01 (354 events)

📈 DIFC Events Over Time

All 354 filtered events cluster on the most recent reporting day, driven by two smoke-test workflows exercising the GitHub MCP server's list_issues/search_issues tools against the full issue corpus (including many public, unapproved issues). This is expected exercise traffic from smoke/validation workflows rather than a genuine anomaly.

🔧 Top Filtered Tools

list_issues (236 events) and search_issues (111 events) together account for 98% of all DIFC filtering, both blocked for the same reason: results included issues tagged unapproved:public, which fall below the agent's configured integrity floor. search_repositories (6) and search_code (1) contributed marginally.

🏷️ Filter Reasons and Tags

100% of filtered events were attributed to "insufficient integrity level" — no secrecy-tag violations occurred this week. Integrity tag none:public appeared on all 354 events, with unapproved:public (252) as the dominant sub-tag and approved:public (7) appearing on a small minority that were nonetheless filtered (likely due to combined result sets containing both approved and unapproved issues).

📋 Per-Workflow DIFC Breakdown

Workflow	Filtered Events
Workflow Normalizer	150
Smoke Agent: public/approved	130
Smoke Temporary ID	47
Smoke Agent: all/merged	13
Smoke Agent: scoped/approved	6
GitHub Remote MCP Authentication Test	5
Issue Triage Agent	2
GitHub MCP Structural Analysis	1

📋 Per-Server DIFC Breakdown

MCP Server	Filtered Events
github	354

👤 Per-User DIFC Breakdown

Author Login	Filtered Events
unknown	352
MattSkala	1
GregoireW	1

💡 DIFC Tuning Recommendations

1. Workflow Normalizer and the Smoke Agent family generate the overwhelming majority of filtered events (333 of 354) by design — these are validation/smoke workflows that intentionally exercise broad list_issues/search_issues calls. Consider scoping their queries with state/label filters to reduce noise if the filtering volume impacts token/latency budgets.
2. Since 100% of events stem from the same "insufficient integrity level" reason with zero secrecy violations, the DIFC integrity policy is functioning as intended — no configuration changes are indicated at this time.
3. Author attribution is missing for 352 of 354 events (author_login: unknown); consider enriching gateway logging to capture the triggering actor for audit-trail completeness, especially for non-smoke workflows.
4. Monitor Issue Triage Agent and GitHub MCP Structural Analysis, which had low but non-zero filtered events — these are production-facing workflows where repeated filtering could indicate legitimate need for broader read access (via an integrity-level review) rather than pure noise.

---

Generated by the Daily Security Observability workflow (consolidated from Daily Firewall Reporter + Daily DIFC Analyzer)
Analysis window: Last 7 days | Repository: github/gh-aw
Run: https://github.com/github/gh-aw/actions/runs/33530583409

Generated by 🔒 Daily Security Observability Report · copilot · auto · 107 AIC · ⌖ 13.5 AIC · ⊞ 15.3K · ◷

• expires on Sep 4, 2026, 8:49 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Security Observability Report.

A newer discussion is available at Discussion #57991.