Security●●●Banger
TunnelMind – reputation API for IPs, ASNs, and ad-tach supply chains
Cross-correlates threat intel across four lenses where incumbents stay siloed.
Big BrainZero to One
o2k
9111mo ago
Back to browse
CI/lock – supply-chain attestation CLI, from the Witness creators
by colek42·Jun 9, 2026·1 point·0 comments
AI Analysis
●●●BangerBig BrainZero to One
From Witness/in-toto creators, keyless attestation blocks poisoned CI runs.
Strengths
- •Keyless signing eliminates long-lived keys that attackers can steal.
- •Policy gating requires human approval before release.
- •Records complete build provenance including commands, inputs, and artifacts.
Weaknesses
- •New tool needs adoption across CI pipelines.
- •Policy authoring requires security expertise teams may lack.
Category
Target Audience
DevOps engineers, security teams, AI agent pipeline operators
Similar To
Sigstore · in-toto · SLSA
Similar Projects
Security●●Solid
I built a Cargo supply chain auditor using Claude and GitHub Actions
Tarball diffing plus Claude analysis catches build.rs backdoors cargo-audit misses.
Big BrainSolve My Problem
T-RN-R
303mo ago
Security●●Solid
CI/Lock – signed evidence of what your CI ran
Unified in-toto evidence across build, scan, runtime—Witness successor from CNCF contributor.
Big BrainSolve My Problem
colek42
1024d ago
Infrastructure●●●Banger
SEL Deploy – Tamper-evident deployment timeline (Ed25519, hash-chained)
Ed25519-chained immutable deployment log—instant detection of tampering or reordering.
WizardrySolve My ProblemBig Brain
chokriabouzid
104mo ago
Developer Tools●●Solid
Action-locker: pin, verify, and vendor GHAs
Single stdlib-only Python file means the supply chain tool has no supply chain.
Big BrainSolve My Problem
sudosteph
4117d ago
Security●●●●Gem
Vett – Scan, sign, and verify AI agent skills before installing
First real supply-chain defense for AI agent ecosystems; catches nation-state-grade payloads.
Zero to OneBig BrainWizardry
nikon
305mo ago