Skip to content
Menu

Governance

Security & policy

3 teams with AI activity this period. 4 security events (Machine Destruction ×1, Force Push ×1, Production Access ×1).

Week of 2026-08-24

Clear filters

Security events this period

4 total · click a category to filter the incident list

What do these categories mean?
Machine Destruction
Destructive filesystem or disk commands — for example rm -rf on system paths, mkfs, writing to /dev with dd, or a fork bomb.
Force Push
git push with --force, -f, or --force-with-lease — can rewrite shared history on a remote.
Cron Jobs
crontab edits — persistent scheduled jobs that can outlive the agent session.
Sandbox Bypass
SSH to localhost / 127.0.0.1 — a common way to escape a tool sandbox into a fuller shell.
Production Access
High-impact production changes — kubectl delete or DROP TABLE against live systems.
Data Destruction
Bulk data wipe patterns — TRUNCATE TABLE or nuke-all-data style commands.
API key to model
API keys or access tokens detected in content headed to the model (OpenAI, Anthropic, AWS, GitHub, generic key assigns). Bodies are not stored.
SPI to model
Sensitive personal or infrastructural secrets in model-bound content — private keys, AWS secret keys, DB connection passwords, or SSN-like patterns. Bodies are not stored.

Showing type Force Push · Clear type

Recent incidents

Latest matches — open a row for who, what, and team.

All incidents

1 row for the current filters

Clear table filters
When Type Who Team Repo Tool
2026-08-24
Force Push blocked Details

Force Push — blocked by the local collector hook

Follow up with the person and their team lead — the tool call was stopped on-device.

rule git_push_force

No command body or prompt text is stored.

Sam Okonkwo platform github.com/northwind/payments-api claude_code