WE CONTAIN TRUST DRIFT

Your supply chain is shifting.We're watching.

Uncain maps your CI/CD trust graph, detects trust drift, and contains threats before the next unsafe run.

TRUST DRIFT

Trust drift is the threat model you never drew.

A tag moves. A maintainer gets write access. A reusable workflow starts inheriting secrets. A dependency beneath an Action adds a runtime download.

None of that needs a CVE. It still changes what your pipeline trusts - and how wide your blast radius gets.

HOW IT WORKS

One graph. Three actions. No alert theater.

Uncain resolves workflows, Actions, reusable workflows, images, manifests, and runtime fetch paths into one execution map.

workflows -> Actions -> images -> packages

We watch for the changes scanners miss: moved tags, permission drift, weakened protections, release authority changes, and disappearing provenance.

tag drift + permission drift + release authority

When policy breaks, Uncain cancels unsafe runs, quarantines refs, and opens remediation paths before the next run lands.

cancel runs + quarantine refs + remediation PRs

NOT ANOTHER SCANNER

Other tools tell you something is wrong after it runs. Uncain maps what changed, why it matters, and what to stop.

Uncain models who trusts whom across workflows, Actions, images, packages, and runtime downloads - not just what shows up in a manifest.

what we map

We look for trust-bearing changes: tag rewrites, permission drift, release authority changes, and evidence that quietly disappeared upstream.

what changed

When the graph says stop, Uncain moves the customer toward a safer state with precise control points instead of another queue notification.

action taken

Every incident is scored against your workflows, your secrets, your environments, and your release paths - the context your team actually needs.

blast radius

WHAT WE FIND

47 of your workflows will execute it on the next push. Two carry deploy authority. Nobody is awake for the first alert.

We built Uncain so you can sleep through that.

EARLY ACCESS

Connect GitHub. Review drift in the portal. Set containment before the next run.