BOTTLENECK
0 articles opened

Front · Before any command · p. 08–09

The one-page mental model

Five minutes here saves an hour of confusion later.

SecureGit is a git wrapper that puts a gate on the two moments code crosses a trust boundary — arrival and departure — and writes a signed receipt for each crossing.

Everything else is elaboration. If you remember one thing, remember: arrival, departure, receipt.

The four layers

Think of it as four layers stacked, each usable without the ones above it. You can adopt one layer and stop. Most people should, at first.

1

Acquisition

Shipped

Fetch untrusted code without executing it. Archive-first, hooks stripped, twelve scanners, then a normal git repo. Adopt this alone and you have already gotten most of the day-one value.

2

Scanning

Shipped

Twelve built-in Rust scanners plus a plugin system that wraps tools you already use. Outputs pretty, JSON, SARIF 2.1.0, or GitLab SAST v15. --write-baseline lets you adopt on a legacy codebase without failing every build.

3

Chain of custody & governance

Shipped

offline chain, batch lookup · designed

Every trust-boundary operation emits a cryptographically signed receipt. A hash-chained audit log captures every security-relevant event. Layered configuration gives security teams a governance surface developers can tighten but not weaken.

4

Supply-chain provenance

Shipped

parts · designed

SBOM anchoring, CVE state at a point in time, license posture, lock-file change records — all attached to the same chain. Releases ship a CycloneDX SBOM, SHA256SUMS, and a Sigstore keyless signature.

What it is not

  • It is not a replacement for git. It wraps git. Your repositories stay normal git repositories. Teammates who do not use SecureGit are unaffected.
  • It is not a malware sandbox. It prevents acquisition-time execution and it scans. It does not analyze behavior, emulate, or detonate anything.
  • It is not a SAST platform. It is not competing with Semgrep or SonarQube on depth. It wraps them and runs them at the right moment.
  • It is not a secrets manager. It brokers access to secrets that live in a real secrets manager.
  • It is not a bundled vulnerability scanner — with one deliberate, narrow exception. It anchors the output of the scanners you already run.
  • It does not make your history trustworthy retroactively. Commits made before you adopted it have no receipts.