TL;DR We're releasing bagel, an open-source CLI that inventories security-relevant metadata on developer workstations. Credentials, misconfigs, and exposed secrets. It's cross-platform, privacy-first, and designed to help security teams understand the attack surface that modern supply chain adversaries are actively exploiting. Stay tuned for more exciting news about how Boost works to secure every part of the modern software factory (developer endpoints included).
We've spent years obsessing over CI/CD pipeline security with poutine, because that was the place where we saw a lot of supply chain risk entering the software factory. But attackers have noticed that there’s another path into your software supply chain: through the machine sitting on your developer's desk.
Developer workstations are credential goldmines. A single compromised laptop typically contains:
Taken together, this represents production-level access sitting outside most security controls. And unlike hardened CI runners, these machines browse the web, install VS Code extensions from marketplaces, run npm install on sketchy packages, and open "technical assessments" from fake recruiters. The attack surface is enormous.
The Shai-Hulud (and Shai-Hulud 2.0 etc) malware campaigns, were a self-perpetuating supply chain compromise engine fueled by stolen developer credentials.
How it concretely leveraged developer laptops:
This is just one example of how this entry point was leveraged. A developer’s laptop is increasingly being recognized by threat actors as an excellent vector into the supply chain of software and organizations.
Developer laptops now carry production-grade access, but they’ve historically been outside formal security controls. We built Bagel as an educational tool to help people better understand their own attack surface so that they can reduce the risk if they get compromised. Even we (the authors of Bagel) found interesting things on our own laptops after running it.
Bagel scans developer workstations and produces a structured JSON report of security-relevant findings. It examines:
Configuration Security:
Secret Detection:
Authentication Posture:
Bagel keeps developers’ secrets private. It never reads or transmits actual secret values.
When Bagel finds a secret, it reports:
It does not report the token itself. The same applies to SSH keys, cloud credentials, and every other secret type. You get full visibility into your exposure without creating new exfiltration risk.
{
"id": "github-token-classic-pat",
"probe": "env",
"severity": "critical",
"title": "GitHub Token Detected (Classic Personal Access Token)",
"path": "env:GITHUB_TOKEN",
"metadata": {
"fingerprint": "sha256:a1b2c3...",
"token_type": "classic-pat"
}
}
# Intel Mac
curl -sL https://github.com/boostsecurityio/bagel/releases/latest/download/bagel_Darwin_x86_64.tar.gz | tar xz
mv bagel /usr/local/bin/
# Apple Silicon
curl -sL https://github.com/boostsecurityio/bagel/releases/latest/download/bagel_Darwin_arm64.tar.gz | tar xz
mv bagel /usr/local/bin/
# Linux x86_64
curl -sL https://github.com/boostsecurityio/bagel/releases/latest/download/bagel_Linux_x86_64.tar.gz | tar xz
mv bagel /usr/local/bin/
# Execute
bagel scan
Poutine secures your pipelines. Bagel secures the environment where code is written, before it ever reaches CI/CD. Together, they apply security controls across a software factory where risks no longer begin at CI/CD.
One important note: Bagel (and Poutine) are open source on purpose. We think these building-block tools should exist in the OSS world, both for transparency and for broad community benefit.
But we also know enterprises have more complex needs than a CLI can solve on its own. If your goal is full, organization-wide control across the entire software factory (policy, enforcement, workflow integration, reporting, and scale) that’s what the Boost platform is for.
Bagel is one piece of a larger shift inside the Boost platform. Attackers don’t respect boundaries between laptops, repos, and pipelines … so neither do we. Think of Bagel as the first step in extending enforceable security controls across the full software factory. We’re just getting started: stay tuned for some big announcements.
Bagel is open source under GPLv3 Star it, fork it, and contribute probes for tools we missed(Roadmap is in issues).
👉 https://github.com/boostsecurityio/bagel