Back · Page 63 · as of v0.12.24 · p. 63
The maturity table
This is the page to hand your security reviewer. Every capability in this issue, in one table.
As of v0.12.24, every capability that was DESIGNED in the first two categories has shipped except two (offline chain, batch receipt lookup). The maturity table is denser at the top than at the bottom, which is the direction any honest table should move.
| Capability | State |
|---|---|
| Archive-first acquisition (zip+history / zip-only / bare), hooks stripped | Shipped |
| Sanitization report on acquire | Shipped |
| Twelve built-in scanners | Shipped |
| External plugin system + managed update manifest | Shipped |
| Staged / diff / tree scanning, severity thresholds | Shipped |
| Output formats: pretty, JSON, SARIF 2.1.0, GitLab SAST v15 | Shipped |
| --report-output (report even when gate fails) | Shipped |
| Baselines with stable fingerprints and RFC3339 expires | Shipped |
| Pre-commit and pre-push hook patterns | Shipped |
| Workflow scripts — 22 shipped | Shipped |
| Server registration and cross-provider search | Shipped |
| Secret handles, execution-boundary resolution, redaction | Shipped |
| Credential store v2 — ChaCha20-Poly1305, machine-bound | Shipped |
| Agent tool surface (54 MCP tools) | Shipped |
| Chain receipts: acquire, commit, push, merge, scan | Shipped |
| Tier A / Tier B evidence distinction | Shipped |
| Push gate on unattested commits | Shipped |
| Layered configuration + org policy floors | Shipped |
| Hash-chained audit log with audit verify | Shipped |
| Compliance report — OWASP Top 10 + NIST SSDF v1.1 | Shipped |
| SBOM anchoring + opt-in OSV lookup + scan_completeness | Shipped |
| Lock-file change receipts + license detection | Shipped |
| Blame with per-line chain overlay | Shipped |
| securegit hf — Hub pull/push/search/scan/pipeline | Shipped |
| Git-parity surface — native + 18 wrappers + External | Shipped |
| Chain offline store with sync-on-reconnect | Designed |
| Batch receipt lookup for large pushes | Designed |
| Integrated chain audit report generator | Designed |
| OS keychain backend | Designed |
| Full lock-file parsing for remaining formats | Designed |
| Incremental scan cache | Planned |
| --jobs parallelism control | Planned |
| WebAssembly sandboxed plugins | Planned |
| Plugin signature verification | Planned |
| GitLab posture analysis (GitHub posture ships) | Planned |
Glossary
- Acquire
- Fetch a repository as an archive, strip hooks, scan, then convert to a normal git repository. The ordering is the security property.
- Anchor
- Record the content hash of an external tool's output in the chain, without bundling that tool.
- Attest
- Add a receipt to a commit after the fact. Produces Tier B evidence.
- Baseline
- A file suppressing a known set of findings by stable fingerprint. Every entry carries reason, creator, timestamp, and optional RFC3339 expiry.
- Handle
- A stable name referring to a secret. Used by humans and agents; never a value.
- Receipt
- A signed, timestamped record binding an operation to an identity and a content hash.
- Scan completeness
- What fraction of a scan actually finished. Zero findings without full completeness is not a clean result.
- Tier A / Tier B
- Forward-attested (daemon witnessed it) versus retro-attested (added after the fact). Never conflated.
- Trojan Source
- CVE-2021-42574. Source-code attack that hides intent using BiDi override, homoglyph, or zero-width Unicode.