Unspool · live demo · recorded analyses

Follow the data.

The real Unspool interface, loaded with recorded analyses from merge request !30. Open one, press Analyze, browse the graph, then open Analysis results & policy to see the probes and the typed decision.

Blocked

The leak candidate

Legacy profiles fall back to record.get("columns"). Static analysis finds nothing; the csv-import-row-probe sees password_hash leave in the response.

Passed

GitLab Duo's fix

Duo's commit keeps the fallback inside the allowlist. The probes run again and all five come back clean.

No policy file

Built-in catalogue

A checkout service nobody wrote a policy for: card_number to a log and email to a response are still caught.

Read-only: these are recorded responses, so edits and repairs are disabled. Source, pipelines and the merge request: gitlab.com/…/unspool · MR !30