Security & Compliance

Enterprise-grade security features including signed commits, DCO support, and compliance-ready audit trails for regulated environments.

Enterprise Security Standards

Meet enterprise security requirements with built-in support for signed commits, developer certificates, and audit trails that satisfy compliance frameworks.

  • GPG-signed commit enforcement
  • Developer Certificate of Origin (DCO)
  • Protected branch validation
  • Security policy enforcement
Security verification:
✓ Commit signature verified
✓ DCO signoff present
✓ Author identity confirmed
✓ Audit trail recorded

GPG Signed Commits

Cryptographic Verification

Enforce GPG signing for all commits to ensure authenticity and non-repudiation. Automatic verification prevents unsigned commits from being pushed.

  • Automatic signing enforcement
  • Signature verification checks
  • Key management integration
  • Trust chain validation

Configuration

Simple configuration to enforce signed commits across your entire team with clear error messages for setup guidance.

# Security configuration
behavior:
require_signed_commits: true
# Git configuration
git config commit.gpgsign true
git config user.signingkey [KEY_ID]

Developer Certificate of Origin

📝 Automatic DCO Signoff

Automatically adds Developer Certificate of Origin signoff to commits, ensuring compliance with open source contribution requirements.

  • • Automatic signoff addition
  • • Proper name and email formatting
  • • Duplicate signoff prevention
  • • Compliance verification

DCO Format

Follows the standard DCO format used by major open source projects like Linux kernel and Docker.

feat: add user authentication
- Implement JWT-based auth
- Add login endpoints
Signed-off-by: John Doe <john@example.com>

Security Policy Enforcement

🔒

Commit Validation

Real-time validation of commit signatures and DCO requirements

🛡️

Branch Protection

Configurable protection for critical branches with confirmation flows

⚠️

Policy Warnings

Clear warnings and guidance when security policies are violated

Protected Branch Security

Multi-Level Protection

Configurable protection levels for different branches with escalating confirmation requirements for critical branches.

  • Configurable protected branch lists
  • Double confirmation for critical branches
  • Branch name validation
  • Push prevention safeguards

Confirmation Flow

Interactive confirmation process that requires explicit acknowledgment before pushing to protected branches.

⚠️ Protected branch detected: main
Proceed? [y/N]
Really push to 'main'?
Type 'main' to confirm:

Real-time Security Validation

🔒 Pre-commit Checks

Comprehensive security validation before any commit is created, preventing security policy violations.

  • • Signature requirement validation
  • • DCO signoff verification
  • • Author identity checks
  • • Configuration policy validation

Post-commit Verification

Additional verification after commit creation to ensure all security requirements were properly applied.

  • • Signature verification
  • • Commit integrity checks
  • • Success confirmation
  • • Error reporting

Configurable Security Policies

Flexible configuration system that adapts to your team's security requirements and workflows.

Policy Configuration

  • • YAML-based security settings
  • • Per-repository configuration
  • • Team-wide policy sharing
  • • Environment-specific rules

Security Features

  • • GPG signing enforcement
  • • DCO signoff automation
  • • Protected branch validation
  • • Large file detection

Validation & Feedback

  • • Real-time policy validation
  • • Clear error messages
  • • Setup guidance
  • • Configuration validation