Repolode
Submit
Legit-Labs

Legit-Labs/legitify

A CLI scanner that checks GitHub and GitLab organizations, repositories and members for security misconfigurations and compliance gaps.

View on GitHubWebsite
Stars
895
Forks
81
Open issues
18
Last commit
2 months ago

What is it?

Legitify analyzes the security configuration of source-code management resources on GitHub and GitLab. It runs built-in policies against organizations, repositories, members, GitHub Actions settings and runner groups, and reports violations with severity levels. Results can be printed as human-readable text, JSON or SARIF, and grouped by namespace, resource or severity.

It is distributed as a single binary and can be installed via Homebrew, as a GitHub CLI extension, or run as a GitHub Action in a scheduled workflow. Scans can be limited to specific organizations, repositories or namespaces, and individual policies can be ignored through a file. Optional OpenSSF Scorecard integration adds repository score checks for GitHub.

The optional gpt-analysis command sends repository or organization metadata to OpenAI for a GPT-based posture summary. Releases include SLSA Level 3 provenance documents for verifying artifacts.

Key features

  • 01Scans GitHub and GitLab organizations, repositories, members, and Actions settings against built-in policies.
  • 02Outputs results as human-readable text, JSON, or SARIF.
  • 03Groups findings by namespace, resource, or severity.
  • 04Runs as a standalone binary, Homebrew package, GitHub CLI extension, or GitHub Action.
  • 05Supports GitHub Enterprise Server and self-hosted GitLab via SERVER_URL.
  • 06Optionally runs OpenSSF Scorecard checks on GitHub repositories.

Use cases

  • Periodically auditing a GitHub organization for risky settings such as unprotected branches or unverified Actions.
  • Running a scheduled CI check that fails or reports when repository policies drift.
  • Auditing GitLab groups and projects for misconfigurations before a compliance review.
  • Feeding SARIF output into code scanning dashboards.

Quick start

  1. 1

    Install legitify with Homebrew

    brew install legitify
  2. 2

    Run an analysis against your GitHub organization with a personal access token

    SCM_TOKEN=<your_token> legitify analyze --org org1,org2 --namespace organization,member

Things to know

  • GitHub requires a personal access token with broad scopes such as admin:org and repo for a full analysis.
  • Fine-grained personal access tokens are not supported.
  • GPT-based analysis sends repository and organization metadata to OpenAI servers.

In collections

CLI & terminal toolsSecurity scanners, audits & threat intel tools

Topics

#security#github#gitlab#devsecops#misconfiguration#supply-chain-security#compliance#cli#ci#devops

FAQ

What is legitify?
A CLI scanner that checks GitHub and GitLab organizations, repositories and members for security misconfigurations and compliance gaps. Legitify analyzes the security configuration of source-code management resources on GitHub and GitLab. It runs built-in policies against organizations, repositories, members, GitHub Actions settings and runner groups, and reports violations with severity levels. Results can be printed as human-readable text, JSON or SARIF, and grouped by namespace, resource or severity.
Is legitify free to use? What license does it have?
legitify is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is legitify still maintained?
Updated within 6 months. The last commit to legitify was on Aug 31, 2026.
What can I use legitify for?
Periodically auditing a GitHub organization for risky settings such as unprotected branches or unverified Actions. Running a scheduled CI check that fails or reports when repository policies drift. Auditing GitLab groups and projects for misconfigurations before a compliance review. Feeding SARIF output into code scanning dashboards.
How do I install legitify?
Install legitify with Homebrew: brew install legitify Run an analysis against your GitHub organization with a personal access token: SCM_TOKEN=<your_token> legitify analyze --org org1,org2 --namespace organization,member
Where can I get legitify?
The source code and installation instructions are on GitHub: https://github.com/Legit-Labs/legitify

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects