oss-forensics

Investigating an OSS supply-chain incident involves aggregating data from local git history, GitHub REST API, archival sources, and evidence store records. This framework applies a phase-based workflow from evidence collection to hypothesis validation, producing a structured forensic report.

Collecting git forensics evidence requires aggregating local commit history with GitHub API data and archival sources like the Wayback Machine. This framework enforces multi-source correlation and an auditable chain-of-custody to ensure defensible incident response conclusions.

Hypothesis validation in supply-chain forensics works by correlating multi-source evidence against investigative criteria. The framework applies anti-hallucination guardrails during cross-source data analysis to test assumptions and generate defensible conclusions in the final reporting phase.

Yes, you need a Python runtime and GitHub access for OSS security investigations. The workflow requires accessing the GitHub REST API and BigQuery as needed, while supporting delegated sub-investigators to manage multi-source evidence collection and correlation.

Yes, you can use archival sources like the Wayback Machine and GH Archive for incident response forensics. The framework integrates these external sources with local git history and GitHub API data to perform cross-source correlation and validate supply-chain attack hypotheses.

Limitations of criteria-based supply-chain incident reporting include dependence on external API access to GitHub and BigQuery, requiring a Python runtime, and strict anti-hallucination guardrails that may constrain rapid ad-hoc analysis outside the structured phase-based workflow.