Security
Threat detection from existing telemetry.
Security uses the telemetry already being sent; no agents or code changes. 28 detectors watch traces, logs and metrics as they arrive: sign-in attacks and enumeration per caller, scanners, unusual destinations, secrets and card numbers in logs, missing security response headers, end-of-life runtimes and vulnerable dependencies. Sections: Overview with a posture score, Findings, Attackers, APIs, Sensitive data, Supply chain, Coverage and Compliance. Findings can be ignored, and AI can explain a finding and the fastest fix. Make it sharper: pass the real client IP as client.address behind load balancers; turn on response-header capture with OTEL_INSTRUMENTATION_HTTP_SERVER_CAPTURE_RESPONSE_HEADERS=content-security-policy,strict-transport-security,x-frame-options; keep SDK resource detection on for runtime versions; POST each service's package list to /v1/dependency-manifest on deploy to scan dependencies against known vulnerabilities (OSV.dev by default; an imported advisory file works fully offline). Workspaces can add threat lists and an IP-geolocation database.