By Role: DevSecOps
Security that ships with the code, not after the breach
A secret was committed to the repository. A container image shipped a vulnerable base layer. A Terraform deployment opened port 22 to the internet. ManySignal catches all three before they become incidents.
Security events across the SDLC
- Secret committed to repository
- Dependency with active CVE introduced
- Insecure code pattern in PR
- Workflow YAML modified to expand secrets access
- Artifact hash mismatch from build to registry
- Unexpected network egress from build runner
- IaC resource violates security policy
- Container image with critical CVE scheduled for deploy
- IAM role with wildcard permissions created
- Runtime behavior outside normal execution profile
- Unexpected external API connection from app
- Production secret accessed by non-service identity
Day in the life: before and after ManySignal
- Security review is a gate at the end of the sprint, not integrated in the pipeline
- Committed secrets discovered during pentests, not at commit time
- IaC misconfigurations found weeks after deployment during compliance scan
- Production runtime anomalies reported by customers, not monitoring
- Deployment and security events live in separate systems with no correlation
- Security findings posted to PRs at commit time — developer sees and fixes immediately
- Secret detection fires within 60 seconds of commit, before CI runs
- IaC policy violations blocked before deployment, not found after
- Runtime anomalies correlated with the deployment that introduced them
- End-to-end visibility from commit identity to production behavior
"ManySignal plugged into our GitHub Actions pipeline in an afternoon. Now every PR gets a security comment, every deployment gets policy-checked, and our production runtime is monitored for anomalies — all correlated to the same commit history."
DevSecOps FAQ
How does ManySignal integrate into CI/CD pipelines?
ManySignal integrates via webhook with GitHub Actions, GitLab CI, Jenkins, and CircleCI. Security events from the pipeline (secret detection, dependency vulnerability alerts, workflow YAML changes, artifact hash anomalies) are ingested and correlated with the identity of the committer and the deployment context. ManySignal can post security findings directly to pull requests and block deployments pending security review.
Can ManySignal monitor infrastructure-as-code deployments for security misconfigurations?
Yes. ManySignal integrates with Terraform, Pulumi, and CloudFormation deployment events. When an IaC deployment creates a resource that violates security policy (open security group, public S3 bucket, overly permissive IAM role), ManySignal alerts immediately and can trigger automated remediation workflows. IaC change history is maintained for forensic investigation if a misconfiguration leads to an incident.
How does ManySignal help DevSecOps teams shift security left without blocking developer velocity?
ManySignal uses a tiered response model: informational findings are reported as non-blocking comments in pull requests, medium findings require a security team acknowledgment before merge, and critical findings (active secrets, known-exploited CVEs in production dependencies) block deployment and page the security team. The threshold configuration is tunable by the DevSecOps team to balance velocity and security posture.
Does ManySignal monitor the runtime security of applications in production?
Yes. ManySignal's eBPF sensor monitors application processes in production: unexpected network connections from app containers, process spawning outside normal execution paths, file system access to sensitive paths, and API calls to external services not in the approved integration list. Runtime anomalies are correlated with recent deployments — if an anomaly appears after a specific deployment, ManySignal flags the deployment as the likely cause.
How does ManySignal handle false positives in CI/CD pipeline security checks without breaking developer workflows?
ManySignal uses a confidence threshold before blocking a pipeline. Findings below the configured confidence level are posted as informational PR comments, not blocks. Developers can acknowledge low-confidence findings with a one-click 'accepted risk' annotation. High-confidence findings (confirmed active secrets, known-exploited CVE in a production-bound artifact) block unconditionally. DevSecOps teams configure thresholds per pipeline stage and per repository classification to balance security gates with developer velocity.
Does ManySignal correlate software supply chain risk with runtime security events?
Yes. ManySignal links the build-time software bill of materials (SBOM) with production runtime telemetry. If a component with a newly disclosed CVE is present in a running container, ManySignal cross-references it with runtime behavior — whether the vulnerable code path has been executed, whether the process has made unusual outbound connections. This moves beyond static vulnerability scanning to runtime exposure context, enabling prioritisation of remediation by actual risk rather than theoretical severity.
Can ManySignal detect secrets or credentials in deployed container images, not just source commits?
Yes. ManySignal scans container images at push time via registry webhook integration (ECR, GCR, Docker Hub, GitHub Packages). Detected secrets in image layers are flagged before the image is admitted to the deployment registry. A hardcoded credential in a base layer that passed source-code scanning because it wasn't in the repo is still caught at the image layer. Image scan results are correlated with the commit history to identify the build that introduced the credential.
How does ManySignal integrate with developer-facing tools so findings reach the team without requiring a separate security dashboard?
ManySignal delivers findings where developers already work: GitHub PR comments, Slack notifications, Jira tickets (auto-created for medium and above), and PagerDuty pages for critical findings. DevSecOps teams configure the delivery channel per finding severity and per team. Security dashboard access is available but not required for day-to-day developer response — the workflow is designed to not force context-switching into a separate security tool.
What is the deployment footprint of ManySignal for a containerised DevSecOps environment?
ManySignal's pipeline integration is agentless — it connects via webhooks to source control, CI systems, and container registries. The runtime eBPF sensor is a lightweight DaemonSet deployed to Kubernetes nodes (or a standalone agent on VMs). It requires no application code changes and no sidecar containers. Resource overhead per node is typically under 2% CPU and 200 MB RAM. Self-hosted deployment via Helm chart is supported for organisations requiring full infrastructure control.
Catch committed secrets, vulnerable dependencies, and IaC misconfigs before production
CI/CD pipeline integration, IaC policy enforcement, and runtime behavioral monitoring — security across the full SDLC.