Multiple repository gates
Manage Pushgate connections across repositories from a shared control plane.
Product reference
Explore the technical details.
Capabilities, example workflows, and integration foundations.
Back to features ↗Workflow examples use your tests and configured mappings. Tool and framework support depends on deployment and version.
Gates & policy
Set the requirements. Put them at the right checkpoint.
Versioned policy releases
Keep the exact signed policy release behind an evaluation or gate assignment.
Scoped policy bindings
Assign requirements to the relevant products and repositories.
Separate approval and activation
Keep policy publication separate from a human approving its gate assignment.
Checks before a push is accepted
Evaluate evidence when Git pushes pass through Pushgate, before forwarding them to GitHub.
Block and Warn modes
Choose enforcement or visibility for a configured repository connection.
Actionable refusal details
Show developers and agents which requirements need attention when a push is refused.
Local policy verification
Verify collected evidence against policy before it reaches the gate.
Evidence collection
Turn everyday engineering work into verifiable records.
Wrap existing commands
Capture evidence from builds, tests, scans, and scripts run on your compute or hosted infrastructure.
Signed attestations
Package execution evidence in signed, open in-toto and DSSE formats.
Keyless signing
Use supported identity-backed signing flows instead of distributing long-lived signing keys.
Trusted timestamps
Attach trusted signing-time evidence to support later signature verification.
Artifact and source binding
Associate evidence with the specific materials and subjects observed during the run.
Test and build evidence
Capture results from your existing test suites and build commands.
Security tool evidence
Collect results from supported vulnerability, secret-detection, and security-scanning tools.
SBOM and dependency evidence
Bring supported software bill of materials and dependency scan outputs into the evidence record.
Execution tracing
Inspect supported process, filesystem, and network observations from a run. Tracing capabilities depend on the host.
Evidence management
Keep a traceable path from a decision to its proof.
Shared evidence storage
Collect signed attestations from developer environments and automated workflows in one place.
Product and repository context
Review evidence in the context of the software and repository it belongs to.
Attestation inspection
Inspect signed subjects, predicate details, signatures, and associated metadata.
Policy evaluation records
See which requirements the supplied evidence satisfied and which failed.
Signed verification summaries
Retain signed verification summary attestations for policy evaluations.
Traceable evidence references
Follow an evaluation or control record back to its supporting attestation.
Technical assurance
Connect technical tests to the controls they support.
Policy-to-control mapping
Link a policy’s evaluation results to one or more controls in a selected catalog.
Control evidence views
Review the policies, per-product and per-repository verdicts, and attestations supporting a control.
FedRAMP 20x KSI mapping
Connect relevant technical evidence to Key Security Indicators using versioned framework mappings.
NIST control catalogs
Organize supporting evidence against controls from the configured NIST catalog.
Explicit evidence gaps
Distinguish a passing evaluation from a failed check, an unevaluated policy, or a control with no bound evidence.
Current-branch context
Keep inactive bindings and results from older or different branch heads distinguishable in control views.
Vulnerability remediation verification
Map a signed rescan or remediation check to the controls it supports, with the tested scope retained.
Disaster recovery rehearsal evidence
Map signed recovery-test results to relevant recovery controls and KSIs.
Configuration verification evidence
Connect signed checks of configuration and drift to relevant control evidence.
Change impact
Keep the connection between code and controls visible.
Control watchpoints
Mark the repository paths, patterns, or code locations that a control depends on.
Changes that affect controls
Surface pull-request changes touching configured watchpoints for review.
Watchpoint context
Retain the label, reason, repository location, and linked controls behind a watchpoint.
Stale watchpoint visibility
Show when a line-based watchpoint needs review after its underlying code changes.
Identity & signing
Know who signed, what they can do, and what was observed.
Agent principals
Enroll agents with explicit identities rather than treating an observed tool name as authentication.
Scoped credentials
Limit service credentials by purpose, audience, and authorized scope.
Credential lifecycle
Manage agent access with credential expiry and revocation.
Workload identities
Support authenticated automated workflows through configured workload identity and signing flows.
Identity-backed signing services
Provide certificate issuance and timestamping services for supported signing workflows.
Distinct trust roles
Keep evidence signers, policy publishers, gate activation actors, and push signers distinguishable.
Tools & open foundations
Fit into the workflow your team already uses.
Developer and CI environments
Run supported checks on your compute or hosted infrastructure, including GitHub Actions, RWX, and Namespace; validate the selected runner and capture mode.
Git workflow integration
Use the Git push boundary as the enforcement point for connected GitHub repositories.
Existing security tooling
Use supported attestors and command execution to bring your current scanning tools into the evidence workflow.
Open attestation formats
Produce evidence based on in-toto and DSSE for machine-readable verification.
Platform APIs
Connect supported platform workflows through its API surfaces.
Versioned framework catalogs
Keep control identifiers and mappings tied to their source catalog.
Cloud & appliance
Choose where your evidence control plane runs.
TestifySec Cloud
Use the hosted platform for a shared team workspace.
Self-contained software appliance
Run the platform UI, API, workflows, evidence storage, and signing services as one application.
Local evidence storage
Keep appliance data on your host, with a configured persistent data directory.
Local identity setup
Use an admin-provisioned deployment without requiring an external identity provider or email service.
Offline license verification
Verify the appliance’s signed license locally without a license phone-home requirement.
Multiple operating systems
Packages for Linux x86-64 and ARM64, macOS Apple silicon, and Windows x86-64.
Single-host evaluation
Run the Platform as a container, single binary, VM image, or AWS Marketplace instance. Plan capacity and availability for your environment.