CASE STUDY
TrustClarity: Supply-Chain Security Analysis and CI/CD Hardening
IMPACT
14 of 20 repositories remediated before TrustClarity production; 3 attack vectors eradicated; SHA-pinned reusable security-scan workflow rolled out to 20 repos; later SHA-pin and merge-base invisibility controls shipped
Org-wide supply-chain security analysis for TrustClarity — malicious code found in 14 of 20 repositories across three attack vectors, remediated in repos before it reached TrustClarity's own production environment, followed by a SHA-pinned reusable CI/CD security pipeline and later hardening controls.
IMPACT AT A GLANCE
14/20
Repos
3
Vectors
20-repo
CI
TIMELINE
Apr–May 2026 incident response and pipeline rollout; Jun–Jul 2026 hardening (nightly PR sweep, action SHA-pin scanner)
ROLE
Solo Full-Stack Consultant — incident response, forensic reconstruction, remediation automation, and centralized CI/CD security pipeline design
TEAM
Solo engagement with TrustClarity engineering stakeholders
THE CHALLENGE
On 2026-04-29, TrustClarity discovered malicious code injected across its GitHub organisation. Fourteen of twenty repositories were infected over an approximately twelve-day window through three vectors: build-config injection, a JavaScript payload disguised as a Font Awesome font file, and a VS Code auto-exec launcher. The organisation needed rapid containment, history-safe remediation, and a centralized CI/CD security pipeline so the same gap could not reopen across every repo.
THE RESULTS
- Identified malicious code in 14 of 20 TrustClarity repositories across 3 attack vectors during a ~12-day injection window; forensic SHA reconstruction established the timeline and a repeatable incident-response standard
- Remediated infected repositories — malicious code removed from working trees and git history — before it reached TrustClarity's own production environment; leadership confirmed no customer data or production credentials were confirmed accessed
- Shipped an automated leftover scanner and restored branch protection after eradication
- Built a versioned, SHA-pinned reusable GitHub Actions security-scan workflow in the shared governance repo and rolled it out to 20 repos
- Closed a CVE-2025-30066-class mutable Actions-ref gap with a full-workflow pin scanner and shipped merge-base-invisibility detection plus a nightly open-PR sweep
THE SOLUTION
Led TrustClarity's org-wide supply-chain response — mapping three injection vectors, remediating infected repositories before TrustClarity's own production environment was implicated, and turning the lessons into prevention. A reusable, SHA-pinned GitHub Actions workflow in the shared governance repo became the org standard, installed across 20 repos. Later hardening added full-workflow action SHA-pin scanning and nightly head-tree scans of open PRs so merge-base-invisible payloads cannot hide in GitHub's default diff view.
TECHNOLOGIES USED
- GitHub Actions
- Semgrep
- Gitleaks
- SonarCloud
- Node.js
Project Details
What was the supply-chain injection problem?
In late April 2026, TrustClarity's GitHub organisation was hit by a coordinated supply-chain injection. Across a roughly twelve-day window, malicious code landed in 14 of 20 repositories through three vectors: obfuscated injection inside a build-tool config file, a JavaScript payload disguised as a Font Awesome font file (fa-solid-400.woff2), and a VS Code task launcher (.vscode/tasks.json) that auto-ran the payload when a developer opened the project. Forensic SHA reconstruction established the timeline, and the response steps were written down as a repeatable incident standard.
The catch is intentionally narrow. Malicious code was discovered and remediated in repositories before it reached TrustClarity's own production environment. Per the leadership summary, no customer data or production credentials were confirmed accessed. This case study does not claim a production breach, customer impact, or runtime compromise.
How was the incident contained and turned into prevention?
Remediation cleared all three vectors from working trees and rewrote git history where payload blobs or cover scaffolding remained in past commits. An automated leftover scanner confirmed a clean post-remediation state, and branch protection was restored so force-push windows used during cleanup could not stay open.
Detection alone was not enough — the same inconsistency that let the incident span many repos would return if every team configured scanners differently. I shipped a versioned, SHA-pinned reusable GitHub Actions workflow in the shared governance repo that runs the org's security-scan pipeline — including Semgrep, Gitleaks, and SonarCloud-facing checks — from one maintained source. Day-0 distribution opened adoption PRs across 20 repositories, with consumer stubs pinned to immutable tags rather than mutable branch refs.
What later hardening closed remaining gaps?
Two control gaps surfaced after the initial rollout and were closed with follow-on tooling:
- Mutable Actions refs (CVE-2025-30066-class): An unpinned third-party Action slipped past checks that only validated the reusable-workflow caller pin. A pin scanner now walks every workflow file and fails on third-party actions that are not full commit SHAs.
- Merge-base invisibility: A PR branch created before a remediation commit can hide payload lines from GitHub's default diff. A nightly open-PR sweep materializes each PR head without running hooks and runs the security pipeline against that tree.
Together with on-push security-scan coverage, TrustClarity gained complementary layers that watch protected branches, open PR heads, and Action pin hygiene — not only the single stub line that first adoption checked.
MORE WORK
OTHER CASE STUDIES
TrustClarity: Buyer Portal Rebuild — Search-First TC 2.0 Platform
IMPACT:
400+ Storybook stories across 130+ components (from 11), WCAG 2.1 AA remediation, RFQ flow with server-side credential fix, and 1,533 lines of storefront code removed for a search-first pivot
React/Next.js rebuild of TrustClarity's core buyer workflows — Figma-to-production, WCAG 2.1 AA, Storybook/Chromatic visual gates, and a search-first architecture that replaced the per-org storefront layer.
TrustClarity: Orchestrating Google Jules Multi-Agent Delivery on the Buyer Platform
IMPACT:
Four signed merges into develop covering AGENTS.md plus three UAT fixes; one additional thumbnail/search fix with a TypeScript no-suppression governance lesson; durable signed-commit / pull-and-re-PR playbook confirmed across later Jules rounds
Production orchestration of Google Jules on the TrustClarity buyer platform — first and second UAT rounds, signed-commit re-PR playbook, prompt discipline, and AGENTS.md governance that kept parallel cloud sessions safe to merge.
TrustClarity: Centralized AI Governance Platform for Multi-Repo Engineering
IMPACT:
Centralized AI governance with ~20 reusable skills, 5 specialized agents, shared sync tooling, Trail of Bits registry growth (10→17), and a 15-repo config-payload forensic scan
Built TrustClarity's centralized AI governance platform — reusable AI skills, specialized agents, shared sync tooling, Trail of Bits skill ingestion, and an in-house config-payload detector used in a 15-repo forensic scan.