Source Control Security

Pick the first of two products.

Open a name for its full profile

GitHub Enterprise Cloud
Capabilities only
GitHub · Commercial · 7 capabilities in this domain
Select
Bitbucket Cloud
Capabilities only
Atlassian · Freemium · 3 capabilities in this domain
Select
Allstar
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Select
Arnica
Capabilities only
Arnica · Freemium · 2 capabilities in this domain
Select
Azure DevOps Services
Capabilities only
Microsoft · Freemium · 2 capabilities in this domain
Select
Chain-bench
Capabilities only
Aqua Security · Open Source · 1 capabilities in this domain
Select
Gitsign
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 1 capabilities in this domain
Select
Legitify
Capabilities only
Legit Security · Open Source · 1 capabilities in this domain
Select

In Source Control Security

GitHub Enterprise Cloud

GitHub · Source Control Security

CommercialCompany

GitHub Enterprise Cloud provides the source integrity controls needed for SLSA Source levels — protected history, required reviews, signature verification and auditable settings — plus identity integration through SSO and SCIM.

What it does8 capabilities · 7 at full coverage

7 of 8 at full coverage, 6 through a named feature, 1 that nothing else provides.

Single Sign-On★PartialIAM · level 1 · 6 providers
Branch Protection & Ruleset Enforcement★FullSCM · via a feature · level 1 · 5 providers
Code Review EnforcementFullSCM · via a feature · level 2 · 4 providers
Commit Signing & VerificationFullSCM · level 3 · 3 providers
Developer & Maintainer MFA Enforcement★FullSCM · via a feature · level 1 · 2 providers
Repository Access GovernanceFullSCM · via a feature · level 2 · 3 providers
Source Control Audit LoggingFullSCM · via a feature · level 2 · 2 providers
Tag & Release ImmutabilityFullSCM · via a feature · level 3 · only provider

What it proves28 controls across 10 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CI/CD Top 105 / 10CICD-SEC-1 CICD-SEC-10 CICD-SEC-2 CICD-SEC-8 CICD-SEC-9
CSF 2.05 / 106DE.CM-03 PR.AA-01 PR.AA-03 PR.AA-05 PR.PS-04
SLSA 1.24 / 16Source L2 — Continuous immutable history Source L2 — Source provenance attestations Source L3 — Enforced technical controls Source L4 — Two-party review
SP 800-204D3 / 11204D-CI-COMMIT 204D-CI-REPO 204D-ZT-IDENTITY
Scorecard3 / 20Branch-Protection Code-Review Webhooks
ASVS 5.02 / 17V10 V6
CIS Controls2 / 18CIS 6 CIS 8
SSDF 1.12 / 42PS.1.1 PW.7.1
DSOMM1 / 19IM-Development-and-Source-Control
S2C2F1 / 25UPD-3

What it stops12 techniques · 4 risks

12 techniques countered, 8 of them common

Adversary-in-the-Middle MFA PhishingVery Common
Valid AccountsT1078Very Common
Account ManipulationT1098Common
Data from Information Repositories: Code RepositoriesT1213.003Common
Maintainer Account TakeoverCommon
Malicious or Compromised OAuth IntegrationCommon
Mutable Tag Hijack of CI Actions and ImagesCommon
Unauthorized Commit InjectionCommon
Long-Con Maintainer Social EngineeringRare
SLSA threat B: Unauthorized change during authoring and reviewSLSA-B
SLSA threat C: Compromised source code management systemSLSA-C
SLSA threat F: Upload of a modified artifactSLSA-F

4 risks reduced

Developer or maintainer account takeoverCritical
Attack on engineering platforms goes undetectedHigh
Excessive standing privilege in engineering platformsHigh
Unreviewed or forged code reaches a releaseHigh

Where it runs4 phases · 1 way to deploy

Capabilities per lifecycle phase

Code5
Release1
Operate3
Monitor1

How it is delivered

SaaS

What it unlocks7 activities · reaches level 4

Program activities its capabilities support, reaching level 4. Supporting an activity is not completing it.

Level 1

MFA and default branch protectionLow effort
SSO and MFA for engineering platformsLow effort

Level 2

Organization rulesets with required reviews and code ownersLow effort
Team-based least-privilege RBAC and access reviewLow effort

Level 3

Continuous source control posture and audit log streamingLow effort
Signed commits and immutable tags and releasesLow effort

Level 4

Two-party review with phishing-resistant MFA and source provenanceMedium effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsPer user subscription

LicensingPer user subscription

Priced peruser per month or year

BillingSubscription

Scales withNamed or licensed users

Total cost

Bundles such as Microsoft 365 E5 spread cost across many products; value depends on actually deploying the included capabilities.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with7 standards · 5 features

Named features

Audit log streamingAudit log streaming in GitHub Enterprise Cloud.
Enterprise Managed Users with SAML/OIDC SSOEnterprise Managed Users with SAML/OIDC SSO in GitHub Enterprise Cloud.
Immutable releasesImmutable releases in GitHub Enterprise Cloud.
Organization and repository rulesetsOrganization and repository rulesets in GitHub Enterprise Cloud.
Required code owner reviewRequired code owner review in GitHub Enterprise Cloud.

Standards and formats

CODEOWNERSGitHub Immutable ReleasesGitHub Repository RulesetsOpenPGP SignaturesSSH Commit SigningSecurity Assertion Markup Language 2.0System for Cross-domain Identity Management

What else to look at2 siblings

Same family

GitHub ActionsFreemium
GitHub PackagesFreemium

What backs this upin 1 pipeline

In use

Payments API release pipeline · Source control

Gantry 7.1.0 · OFF.12 · OFF.13