A Better Way To Secure GitHub/GitLab.

Legitify is an open-source security tool for GitHub or GitLab used to automatically discover insecure configurations.

Security where code is written.

Connect Easily

Legitify connects to GitHub and GitLab via an access token and detects issues across various resource types: member, repository, actions, organization, and more. Legitify provides the option to scan by specific GitHub/GitLab instance and/or resource type, or to scan an entire GitHub organization, or GitLab group, across all resource types.

Scan Quickly

Legitify rapidly scans your GitHub implementations via the command line to detect a wide range of security issues associated with GitHub configurations and settings. Use Legitify across an entire GitHub organization of any size.

Detect Security Issues

Any security issue detected is listed in the results, including the name of the issue with a brief description and severity categorization. Threat examples and remediation steps are also provided along with the entityID of the violation.

Legitify detecting security issues and misconfigurations

Obtain Security Scores

Legitify is integrated with OSSF Scorecard so you can run Scorecard within Legitify to assess the security posture of repositories using the Security Scorecard framework.

Legitify vs. the Legit Security platform

Legitify

Supports GitHub and GitLab

Detects SCM misconfigurations only

Compliance reporting for OSSF SCM Best Practices

Policy drifts detection can be detected periodically through Legitify's GitHub Action

SDLC assets management not supported

Issue & policy management not supported

Code to cloud context not supported

Workspaces and product groups not supported

Ticketing and alerting not supported

Risk ingestion not supported

Rest APIs not supported

Legit Security

Supports all major SCMs (incl. Azure DevOps, Bitbucket and more), CI/CD systems (e.g. Jenkins), package registries (e.g. JFrog Artifactory), cloud providers (e.g. AWS) and AI code assistants (e.g., Claude Code, Cursor,  GitHub CoPilot)

Detects SCM misconfigurations, CI misconfigurations, CD misconfigurations, package registry misconfigurations, pipeline risks, secrets, IaC, security incidents, AI code issues, risky MCPs and skills, and more

Compliance reporting for SSDF, SLSA, SOC2, ISO 27001, FedRAMP and more

Policy drifts detection deliver real-time alerts when a  misconfiguration is introduced

SDLC assets management supported

Issue & policy management supported

Code to cloud context supported

Workspaces and product groups supported

Ticketing and alerting supported via Jira, Slack and more

Risk ingestion supported via API integration with SAST, SCA and other AppSec testing tools

Rest APIs supported

How to Download and Documentation

Get the latest version of Legitify by downloading below and read through the documentation for an in-depth look at how our tool works.

Download Now

Documentation

95%+

reduction in false positives for secret scanning

FAQ

What is Legitify?

Legitify is an open-source security tool for GitHub/GitLab users to automatically discover insecure configurations.

What are examples of security issues that Legitify detects?

Legitify can help you identify security risks that relate to misconfigurations of different SCM resource types. For instance, organization-level misconfigurations such as “Two-Factor Authentication Is Not Enforced For The Organization”, or repository-level misconfigurations such as “Code Review By At Least Two Reviewers Is Not Enforced”.

How can I fix the issues that Legitify raised?

All policies in Legitify are documented here, and the last section of each policy is a description of the remediation steps required for the fix. In the future, we plan to add automatic remediation.

What is Legitify's open source licensing model?

Legitify is licensed under the Apache License 2.0.

What are the Legitify GitHub policies?

You can find all of the GitHub policies in the Legitify documentation.

What type of support is provided?

Legitify’s maintainers are devoted to the project and are happy to receive issues from users and pull requests from contributors. All issues/PR contributions will be addressed as soon as possible.

How can I contribute to improve Legitify?

We happily welcome the contribution of code to all the components in the project.

What SCMs are currently supported by Legitify?

GitHub Cloud, GitHub Enterprise Server, GitLab Cloud, GitLab Server

How can I run Legitify as a part of a CI/CD pipeline?

GitHub users can call the Legitify GitHub Actions as part of a workflow that will run an analysis periodically or upon triggers of interest.

What are the Legitify GitLab policies?

You can find all of the GitLab policies in the Legitify documentation.

Go from insights to action.

Everything you need to move from what you know to what you do.

Schedule a Demo

Chat over Slack