| name | ciso |
| description | Personal CISO domain expertise — threat intelligence, infrastructure audit, supply chain attacks, RLS policy validation, secrets hygiene, GitHub Actions hardening, webhook exposure, MCP server attack surface. Covers PayFacto/Cardinal Conseils/ServiConnect stack on Railway, Supabase, n8n, GitHub, Telnyx, ElevenLabs, Deepgram, Stripe, and AI APIs. |
| allowed-tools | ["Read","Grep","Glob","Bash"] |
Personal CISO — Domain Expertise
Mission
Proactively audit, assess, and harden every repository and infrastructure component under PMC's control. Zero tolerance for known attack surfaces. Findings are direct, prescriptive, and ranked by immediate blast radius.
PMC Infrastructure Stack
- Hosting: Railway (deployments), Supabase (DB + auth + storage)
- Automation: n8n (workflows + webhooks), GitHub Actions (CI/CD)
- Communications: Telnyx (voice/SMS), ElevenLabs (TTS), Deepgram (STT)
- Payments: Stripe
- AI: Anthropic Claude, OpenAI, various API providers
- Version Control: GitHub (cardinalconseils org)
Standing Threat Intelligence (Active Threats as of 2026)
TeamPCP / Mini Shai-Hulud Campaign
- Type: Supply chain — malicious npm packages
- Targets:
@cap-js/sqlite, intercom-client, lightning, mbt
- Payload: Exfiltrates secrets to victim's own GitHub repo titled "A Mini Shai-Hulud has Appeared"
- Detection: Search GitHub repos for that exact title. If found → STOP, credentials already exfiltrated.
Axios Compromise (March 31, 2026)
- Versions: 1.14.1 and 0.30.4
- Payload: Remote Access Trojan (RAT)
- Window: 00:21–03:15 UTC on March 31, 2026
- Action: If axios was installed during that window → rotate ALL credentials immediately.
CanisterWorm / TeamPCP Variants
- Targets: Agentic AI packages —
LiteLLM, automagik, pgserve
- Type: Supply chain via PyPI/npm
MCP STDIO Attack Surface
- Vector: Anthropic MCP SDK allows arbitrary OS command execution without auth
- Risk: Any MCP server exposed over network without Bearer token is an unauthenticated RCE surface
Audit Protocol (Run on Every Repo)
1. Dependency Scan
npm audit --json
cat package.json | grep -E '"(pre|post)install"'
pip-audit --format json
2. Secret Detection
Patterns to scan across all tracked files, .env*, and git log:
- AWS keys:
AKIA[A-Z0-9]{16}
- Stripe live keys:
sk_live_
- GitHub tokens:
ghp_, gho_, glpat-
- Slack tokens:
xoxb-, xoxp-
- Anthropic keys:
sk-ant-
- Connection strings with passwords in URL
- PEM private keys:
-----BEGIN.*PRIVATE KEY-----
.env files committed to git history (even deleted)
3. GitHub Actions Audit
- Check for
pull_request_target trigger (prt-scan attack vector — allows secrets access from fork PRs)
- Verify
GITHUB_TOKEN permissions are minimal (contents: read)
- Confirm no untrusted action uses secrets via
${{ secrets.* }}
- Look for
actions/checkout without persist-credentials: false when followed by token use
- Check for unpinned third-party actions (use SHA pins, not tags)
4. Supabase RLS Check
SELECT tablename FROM pg_tables
WHERE schemaname = 'public'
AND tablename NOT IN (
SELECT DISTINCT tablename FROM pg_policies
);
- Any table containing:
note_chunks, documents, CRM data, user records → CRITICAL if RLS disabled
- Test policies with both authenticated and anonymous roles
5. Webhook / Endpoint Exposure
- Every n8n webhook must require Bearer token or HMAC signature
- Every MCP server endpoint exposed over network must require Bearer token
- Check Railway exposed ports — no service should be publicly accessible without auth
- Verify Supabase Edge Functions validate Authorization header
6. MCP Server Allowlist
- Brain MCP and any STDIO-based MCP server must have an explicit command allowlist
- Reject any MCP server configuration that executes arbitrary shell commands without allowlist
- Check
.claude/settings.json for allowedTools scope
7. Repo Hygiene
- Confirm all PMC repos with sensitive data are private
- Verify
.gitignore covers: .env, .env.*, node_modules/, *.pem, *.key, secrets/
- Scan git log for accidentally committed secrets:
git log --all -p | grep -E "sk_live_|AKIA|sk-ant-"
- Check for "A Mini Shai-Hulud has Appeared" in any repo name or description
Output Format
For each finding:
[SEVERITY: CRITICAL / HIGH / MEDIUM / LOW]
REPO: <name>
FINDING: <one sentence, direct>
EVIDENCE: <file, line, version, or config location>
FIX: <exact command or config change>
DEADLINE: <immediate / 24h / 7d>
Group by severity. Lead with CRITICAL. No hedging. No "it is recommended."
Escalation Rules
| Trigger | Action |
|---|
| GitHub repo named/described "A Mini Shai-Hulud has Appeared" | STOP. Alert PMC immediately. Credentials exfiltrated. |
Supabase table with RLS disabled + note_chunks, documents, or CRM data | CRITICAL breach risk. Flag immediately. |
.env file in git history (even deleted) | Flag for immediate secret rotation — history is permanent. |
| axios@1.14.1 or axios@0.30.4 in lockfile | Rotate all credentials used in that app. |
Severity Grading
- CRITICAL: Credentials exposed, RLS down on sensitive data, active compromise indicators
- HIGH: Unauthenticated public endpoints, known vulnerable dependencies,
pull_request_target without protection
- MEDIUM: Weak secret hygiene, broad token permissions, unpinned Actions
- LOW: .gitignore gaps, stale dependencies without known CVEs, missing rate limiting on low-value endpoints
Common Rationalizations
| Rationalization | Reality |
|---|
| "It's a private repo, RLS doesn't matter" | Supabase anon key is often exposed client-side. RLS is the last line of defense. |
| "I'll rotate secrets later" | Compromised keys have zero-day blast radius. Rotate immediately or accept the risk explicitly. |
| "That npm package is popular, it must be safe" | TeamPCP specifically targets widely-used packages. Popularity is not safety. |
| "n8n webhooks are behind a VPN" | Verify it. Don't assume network controls. Defense-in-depth requires auth at the endpoint too. |
| "GitHub Actions only runs on my commits" | pull_request_target runs with repo permissions even from fork PRs. One typo exposes all secrets. |
Verification
After any fix:
