Skip to main content
Most scanners grade each finding in isolation. But real compromises are rarely a single misconfiguration — an attacker chains several. A pull_request_target workflow that checks out untrusted code is risky on its own; combine it with a writable GITHUB_TOKEN and it becomes a full repository takeover. Attacker Mind is Pipefort’s correlation layer. It looks across the findings from a scan and reports toxic combinations: named attack scenarios that exist only when a set of findings co-occur. Each combination carries:
  • a severity — CRITICAL or HIGH (toxic combinations sit above the per-finding severity scale, because the chained impact exceeds any single ingredient);
  • an attack chain — the ordered stages of the compromise, so you can see what the attack actually looks like;
  • the contributing findings with their file:line locations; and
  • a break-the-chain recommendation — the single highest-leverage fix that collapses the whole scenario.

​
How detection works

Combinations are pure correlation over findings that the scanner already produced, so the same engine powers both the CLI and the web dashboard. Combinations are matched on rule IDs (not OWASP categories), because a category like CICD-SEC-4 is emitted by more than one rule (workflow shell-injection and the read-write GITHUB_TOKEN repository setting) — matching on rule ID keeps each ingredient precise. A combination only forms from findings that survived your rule settings: if you disable a rule, it can never be an ingredient. Combinations are scoped:
  • file-scoped combinations require their anchor ingredient inside one workflow file and are reported once per such file;
  • repo-scoped combinations correlate across the whole repository and are reported once.

​
The shipped combinations

​
GitLab combinations

The same engine correlates GitLab CI findings. These mirror the GitHub scenarios for .gitlab-ci.yml:

​
Where to see them

  • CLI — every scan prints an Attacker Mind — Toxic Combinations section after the findings (and includes them under the toxic_combinations key in JSON output).
  • Web app — the Attacker Mind dashboard aggregates combinations across all your repositories and draws each attack chain. It also names the ones on this page that produced nothing, and keeps those apart from any a disabled rule made undetectable — see what else was looked for.
This table is the denominator. A scan that reports no combinations has either evaluated all of them and matched none, or has been blinded by rule policy for some of them; those are opposite conclusions, and only the web app currently tells them apart. The CLI prints detections alone.