Secret scanning, code scanning and signed commits

gitfor rejects pushes that contain credentials, shows code scanning alerts on pull requests, and verifies who signed each commit.

Create an account All features

$ git push origin main

Enumerating objects: 7, done.

Writing objects: 100% (4/4), 412 bytes, done.

remote: gitfor: PUSH REJECTED — push protection found secrets in this push.

remote: - AWS access key (AKIA…7Q2M) in blob 9c41e0a, line 12

remote: review or bypass: …/security/secret-scanning/unblock/…

! [remote rejected] main -> main (pre-receive hook declined)

$ git commit --amend && git push origin main

3f9a21c..b72d0e4 main -> main

Push protection: A push that contains a credential is rejected with the file and line, before the secret reaches your history.
Code scanning: Upload SARIF from any analyzer. Alerts appear on the affected lines and on pull requests.
Advisories and dependencies: Draft private security advisories and see every dependency your manifests declare.
Verified commits: GPG and SSH signatures are checked against each author's registered keys and shown on every commit.

Account security

Passkeys, TOTP and recovery codes, plus fine-grained and deploy tokens. Raw files and uploads are served from a separate domain that can't read your session.

Try it on your own code

Create an account and import a repository with its full history, or run your own instance.

Create an account Self-host gitfor