The TestifySec blog
Engineering lessons, product perspectives, and the work behind developer and agent trust.
57 articles
An enrolled TestifySec agent identity mints a five-minute, single-use token that Anthropic exchanges for Claude access through workload identity federation. No Anthropic key is stored anywhere.
Inspect the work a test performs, then change a relevant input to check whether its cached result is invalidated.
Give developers and agents the same requirements at the Git push boundary, with decisions you can inspect.
Review which configured compliance controls a pull request may affect, with an informational check in the developer workflow.
Why agent-written code needs inspectable execution evidence, protected signing authority, and a separate acceptance decision.
What our original build experiment demonstrated, where its SLSA claim failed, and how to evaluate the signing boundary.
Use a reviewed package inventory and an enforced verification step to catch unwanted release contents.
Separate test execution from deployment authority, scope credentials, and verify the artifact you promote.
Separate package integrity, runtime observation, and incident response when assessing a compromised dependency.
A review of the March 2026 incident and the distinct roles of prevention, observation, and policy verification.
Articles retain their publication dates. For current product behavior and setup instructions, use the documentation.
Ready to try a workflow?
Find the right starting point for CI/lock, Pushgate, or the platform.
