DevSecOps and Software Supply Chain
Source Repository Security
We configure access, protected branch rules and required code reviews in your repositories. No one can deploy code to production alone.
What it is
The source repository is where every change heading to production starts. An account that can write directly to the main branch or disable rules can bypass review entirely. Admin accounts, deploy keys and connected apps are as important as developer accounts. The review evaluates platform settings and actual permissions in each repository together.
Scope
- Organization and repository permissions, admin accounts and multi-factor authentication
- Protected branch rules and accounts that can bypass them
- Required reviews and code ownership (CODEOWNERS) definitions
- Deploy keys, access tokens and connected third-party applications
- Signed commits and release tags
- Removal of access for departing employees and suppliers
The need
When organizations need it
- When migrating your repositories to another platform or moving from on-premises to the cloud.
- When you grant repository access to external developers or suppliers.
- When you need to prove in an audit that every change to production is reviewed by a second person.
Method
How we work
-
Inventory
We list all repositories, accounts, tokens and connected apps with their permissions.
-
Rules
We define protected branch, required review and code ownership rules based on each repository's criticality.
-
Clean-up
We plan removal of unused access and over-privileged tokens.
-
Continuity
We set up regular checks to detect if rules are later relaxed.
Outcome
What you have at the end
It is clear who has access to each repository and with what permissions. Every change to production requires at least one approval, and accounts that can bypass this rule are limited and logged.
Frequently asked questions
Do admin accounts need to bypass the rules?
In emergencies, this may be necessary. The privilege is limited to a few accounts, creates an audit record when used, and is reviewed afterward.
Are signed commits really necessary?
A signature shows a commit came from the claimed person. We recommend it for critical repositories and release tags. It is not sufficient alone. It is meaningful together with required review.
Are our public repositories in scope?
Yes. Public repositories are checked for accidentally published code or secrets, and how external contributions are accepted.
DevSecOps and Software Supply Chain
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting