Source Control Security

Now pick what to compare Chain-bench against.

Chain-bench clear

Open a name for its full profile

GitHub Enterprise Cloud
Capabilities only
GitHub · Commercial · 7 capabilities in this domain
Compare →
Bitbucket Cloud
Capabilities only
Atlassian · Freemium · 3 capabilities in this domain
Compare →
Allstar
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Arnica
Capabilities only
Arnica · Freemium · 2 capabilities in this domain
Compare →
Azure DevOps Services
Capabilities only
Microsoft · Freemium · 2 capabilities in this domain
Compare →
Chain-bench
Capabilities only
Aqua Security · Open Source · 1 capabilities in this domain
selected
Gitsign
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 1 capabilities in this domain
Compare →
Legitify
Capabilities only
Legit Security · Open Source · 1 capabilities in this domain
Compare →

In Source Control Security

Bitbucket Cloud

Atlassian · Source Control Security

Close ×

FreemiumCompany

Bitbucket integrates with Jira and supports required approvals, merge checks and Bitbucket Pipelines OIDC to cloud providers.

What it does4 capabilities · 2 at full coverage

2 of 4 at full coverage.

Workload Identity FederationPartialSECRETS · level 3 · 16 providers
Branch Protection & Ruleset Enforcement★FullSCM · level 1 · 5 providers
Code Review EnforcementFullSCM · level 2 · 4 providers
Source Control Audit LoggingPartialSCM · level 2 · 2 providers

What it proves23 controls across 10 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CI/CD Top 104 / 10CICD-SEC-1 CICD-SEC-10 CICD-SEC-2 CICD-SEC-6
CSF 2.04 / 106DE.CM-03 PR.AA-03 PR.AA-04 PR.PS-04
SLSA 1.24 / 16Source L2 — Continuous immutable history Source L2 — Source provenance attestations Source L3 — Enforced technical controls Source L4 — Two-party review
SP 800-204D3 / 11204D-CD-SECRETS 204D-CI-REPO 204D-ZT-IDENTITY
SSDF 1.12 / 42PS.1.1 PW.7.1
Scorecard2 / 20Branch-Protection Code-Review
ASVS 5.01 / 17V9
CIS Controls1 / 18CIS 8
DSOMM1 / 19IM-Development-and-Source-Control
S2C2F1 / 25UPD-3

What it stops8 techniques · 4 risks

8 techniques countered, 6 of them common

Leaked Secret AbuseVery Common
Valid Accounts: Cloud AccountsT1078.004Very Common
Account ManipulationT1098Common
Data from Information Repositories: Code RepositoriesT1213.003Common
Steal Application Access TokenT1528Common
Unauthorized Commit InjectionCommon
Long-Con Maintainer Social EngineeringRare
SLSA threat B: Unauthorized change during authoring and reviewSLSA-B

4 risks reduced

Leaked credential enables unauthorized accessCritical
Attack on engineering platforms goes undetectedHigh
Pipeline secrets exfiltrated from runners or logsHigh
Unreviewed or forged code reaches a releaseHigh

Where it runs5 phases · 1 way to deploy

Capabilities per lifecycle phase

Code2
Build1
Deploy1
Operate1
Monitor1

How it is delivered

SaaS

What it unlocks6 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 1

MFA and default branch protectionLow effort

Level 2

Organization rulesets with required reviews and code ownersLow effort

Level 3

Continuous source control posture and audit log streamingLow effort
Replace static CI credentials with OIDC federationMedium effort

Level 4

Two-party review with phishing-resistant MFA and source provenanceMedium effort

Level 5

Secretless workload identity everywhereHigh effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsPer user subscription · free tier

LicensingPer user subscription

Priced peruser per month or year

BillingSubscription

Scales withNamed or licensed users

Total cost

Bundles such as Microsoft 365 E5 spread cost across many products; value depends on actually deploying the included capabilities.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with1 standard

Standards and formats

OpenID Connect

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13