🎯Basically, Legitify checks GitHub and GitLab settings to find security problems.
What It Does
Legitify is an innovative open-source tool developed by Legit Security. It focuses on identifying security misconfigurations within GitHub and GitLab environments. This tool is essential for organizations looking to enhance their security posture against software supply chain attacks, which often exploit misconfigured settings.
How It Works
Legitify evaluates configurations across five critical namespaces:
- Organization-level settings
- GitHub Actions configurations
- Member accounts
- Repositories
- Runner groups
The tool checks for various policy violations. For example, it ensures that two-factor authentication is enforced, verifies that GitHub Actions runs are restricted to verified actions, and checks for the presence of stale admin accounts. Users can customize scans using command-line flags to target specific organizations or repositories, allowing for flexibility in how the tool is utilized.
Output and Integration
The results from Legitify scans can be exported in multiple formats, including human-readable text, JSON, or SARIF. The SARIF format is particularly useful as it allows findings to be integrated into code scanning tools and security dashboards that support this standard. Scan results can be grouped by namespace, resource, or severity, providing a clear overview of potential issues.
Legitify can operate as a standalone command-line tool or as a GitHub Action, enabling scheduled scanning within existing CI workflows. Additionally, it integrates with the Open Source Security Foundation’s Scorecard project, running checks against repositories and flagging any scoring below a certain threshold.
Platform Requirements and Limitations
To use Legitify effectively on GitHub, users need organization owner permissions. For GitLab, it operates on both GitLab Cloud and self-managed instances, though some policies may be skipped for non-premium accounts. Users must have specific personal access tokens to run the tool, which ensures that the necessary permissions are in place for scanning.
Why It Matters
Security misconfigurations are a common entry point for attackers. By using Legitify, organizations can gain visibility into their settings and take proactive measures to secure their environments. This open-source tool empowers teams to maintain better security hygiene and respond swiftly to potential vulnerabilities, ultimately strengthening their software supply chain security.
🔒 Pro insight: Legitify's integration with Scorecard enhances its utility, allowing teams to automate compliance checks within their CI/CD pipelines.
