Field notes
taggedsecurity· 2 posts
We tried to build org-wide dependency and model file visibility on GitHub's APIs. The Dependency Graph only reads the default branch, Code Search can't be trusted for compliance, and model files register nowhere at all.
Copilot CLI runs an unattended SRE agent for us on a schedule and it does the job. It also won't stop you from wiring it up unsafely, and the tool flags aren't the security model.