Scope the evidence
which logs exist (app, auth, cloud audit, CDN, DB); time window; preserve originals read-only.
The pack · 13 / 14 →
Incident
Saint Bernard
the incident response dog. After a breach: reads the logs, builds the timeline, sizes the blast radius, lists containment steps.
access.log
1210.0.4.2 "GET /health" 200
1310.0.4.2 "GET /health" 200
14185.220.1.9 "GET /.env" 200 1532→ rotate every key in .env, block 185.220.1.9, start timeline at 02:14
15185.220.1.9 "POST /api/admin/export" 200
16
.env served to an attacker
ExploitAll app secrets leaked at 02:14 UTC
FixSmallest change suggested
Saint Bernard is watching$ /watchdog-go-incident0 found · 0 fixed
What it does
On duty while you build.
The incident-response dog. Comes to the rescue after something went wrong: reads logs, builds a timeline, finds blast radius and writes containment steps.
The always-on lens watches incidents, breaches, suspicious logs, alerts, compromised keys, post-mortems.
What it checks
6 things Saint Bernard looks for.
Timeline
first sign, initial access, actions taken, last activity; with log line references.
Indicators
IPs, user agents, accounts, keys, files and endpoints involved.
Blast radius
data, accounts, systems and secrets the attacker could reach from what was used.
Containment
keys to rotate, sessions to revoke, accounts to lock, rules to add; ordered by urgency.
Root cause and follow-up
the weakness exploited and which Watchdog dog guards it next time.
Commands
Send Saint Bernard out.
Runs these scanners when installed, then reads the code they can't understand:
- jq
- rg
- chainsaw
- sigma
Read logs after a breach: timeline, blast radius, containment steps
Benchmark
Tested, not promised.
Its test target holds an evidence folder (nginx, app, auth logs, CloudTrail-style events, git log, ticket) with one planted intrusion as 17 facts, 3 decoys and an answer key.
facts
Haiku 5.516/17
Sonnet 5.516/17
Opus 5.517/17
Rules of engagement
What Saint Bernard will never do.
- 1
Static review only. Never change live systems or send traffic to targets outside the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Saint Bernard, answered.
What does Saint Bernard check for?
Saint Bernard is Watchdog's incident dog for Claude Code. It looks for Scope the evidence, Timeline, Indicators, Blast radius, Containment and Root cause and follow-up. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Saint Bernard in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-incident. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Saint Bernard use?
When they're installed, Saint Bernard runs jq, rg, chainsaw and sigma, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Saint Bernard safe to run on my project?
Yes. Its first rule: Static review only. Never change live systems or send traffic to targets outside the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).