Prevent supply chain attacks before they reach your CI/CD pipeline. Every dependency pinned. Every secret scoped. Every drift detected.
curl -sSL https://scg.data-insights.ai/install.sh | sh
Every mutable reference (tag, version, branch) is resolved to an immutable content hash and locked in scg.lock. If the hash changes, the build halts.
Each CI tool has a security profile defining what secrets it needs. scg scope identifies and optionally removes secrets the tool shouldn't see.
Powered by a temporal knowledge graph. SCG tracks every resolution over time and detects the moment any dependency changes unexpectedly.
| Attack | Date | Impact | Defense |
|---|---|---|---|
| tj-actions/changed-files | Mar 2025 | 23,000+ repos | digest pinningsecret scoping |
| reviewdog/action-setup | Mar 2025 | CISA KEV | digest pinning |
| Codecov Bash Uploader | 2021 | 29,000+ customers | digest pinningsecret scoping |
| ua-parser-js (npm) | Oct 2021 | 7M+ downloads | digest pinning |
| event-stream (npm) | Nov 2018 | 8M installs | digest pinning |
| PyTorch torchtriton | Dec 2022 | 2,700+ downloads | digest pinning |
| PyPI typosquatting | 2022-2025 | 500+ packages | digest pinning |
scg init scans your workflow files, resolves every dependency to an immutable hash via the SCG Platform, and writes scg.lock.
scg check in CI re-resolves and compares. If any hash changed — tag hijacking, dependency confusion, typosquatting — the build halts.
scg scope audits which secrets each step can access. Forbidden secrets are identified and optionally stripped from the environment.
The SCG Platform continuously crawls and resolves all known CI/CD tools. The CLI queries the platform by default — no GitHub token, no registry accounts, no configuration needed.
No account needed. scg check queries the platform automatically. Enough for any single repo.
Continuous monitoring. Webhook alerts on drift. Temporal history. Multi-repo dashboard.
Custom policies. SBOM generation. SLA. Self-hosted option.
curl -sSL https://scg.data-insights.ai/install.sh | sh
Download binaries · Install script · Source code · Platform status