This lab uses public incident reporting and sanitized synthetic artifacts for defensive OSINT training. Real incidents are referenced for educational context only. The interactive data is fictionalized and must not be used to identify, contact, expose, or accuse real people.
Trusted Build, Wrong Source
Compare approval, branch history, workflow permissions and provenance to find where the release source stops matching.
Synthetic training evidence that stays internally consistent. Check the repository history, the timestamps, the hashes and the agreement between sources. Never extend the scenario to real people or infrastructure.
01Incident summary
Release 0.8.4 has a normal-looking name and came from the usual automation identity. That is not enough. The approved source was main, and the provenance record points at a maintenance branch and a different commit. The preserved workflow also carries wider permissions than its local build step needs, and it calls an action by a mutable tag.
02Analyst mission
Resolve the exact build commit from Git history. Compare it with the approval and the provenance record. Point out the two workflow control weaknesses without reading them as proof of who did it.
03Review the evidence
Evidence route
Open the public repository and preserve these records before you draw a conclusion.
| Indicator Type | Evidence path | Analytical Context |
|---|---|---|
| Build comparison | evidence/act-3/build/approval-vs-build.csv | Find the mismatched ref, commit and package digest. |
| Maintenance branch | refs/heads/maintenance/harbor-map | Inspect the release commit, the workflow and the tag in full history. |
This table shows file paths and Git refs in the public evidence repository. None is a live scanning target.
04Tasks
4 steps- 01
Fetch every branch and tag before you compare history.
- 02
Resolve the commit the provenance record points to.
- 03
Compare the approved and observed ref, commit, actor and package digest.
- 04
Write mutable action pinning and over-scoped permissions as two separate weaknesses.
05Log your findings
Evidence Notebook
Use this panel to log individual threads of evidence. Your entries are saved locally in this browser only.
No evidence records logged yet.
06Write the report
Report Drafting Board
# CSINT Incident Lab Report ## Research Question Resolve the exact build commit from Git history. Compare it with the approval and the provenance record. Point out the two workflow control weaknesses without reading them as proof of who did it. ## Summary No analyst summary provided yet. ## Fact - No forensic facts recorded in the notebook. ## Signal - No analytical signals logged. ## Inference - No alternative explanations recorded. ## Recommendation - No next-pivot recommendations recorded. ## Confidence Low ## Limitations No limitation notes entered. ## Source reliability Not assessed. Annotate each source with its reliability tier before publishing. ## Information validity Not assessed. Confirm whether each item is directly observed, reported, or inferred. ## Missing context Not recorded. List what data is missing or could not be verified from public sources. ## Next safe steps - No next safe steps specified. ## Sources used - No source references listed. --- Generated at: pending