Legitify

Legitify is a policy-as-code tool that continuously audits GitHub and GitLab configurations for security misconfigurations including overly permissive branch protections, excessive admin access, disabled required code reviews, and insecure repository settings that create supply chain attack vectors. It maps findings to SLSA supply chain security framework requirements and provides prioritized remediation guidance for each misconfiguration. DevSecOps and platform security teams use Legitify to enforce SCM security baselines and continuously monitor for configuration drift that could expose their source code and CI/CD pipelines to supply chain attacks.