Skip to main content

Record the work. Prove what ran.

CI/lock is TestifySec’s enterprise attestation tooling, built on the in-toto™ specification. Capture signed evidence from the builds, tests, and scans your developers and agents already run.

Install CI/lockCapture your first resultView on GitHub →
❯ We pin [email protected] in CI. Before we ship, check
  whether it's safe and gate the release.

⏺ cilock run --step ci-task --trace -a environment,secretscan -- ./build-helper.sh
  ⎿ cilock: tracing mode = eBPF (kernel-side capture)
     ⚠ process tree: cat /proc/self/environ · cat aws-credentials
     ⚠ connect() 169.254.169.254:80  (cloud metadata SSRF)
     ⚠ secretscan: github-pat leaked

⏺ cilock verify -p ci.policy.signed.json ...
  ⎿ ✗ Verification failed — credential leak detected in CI step

⏺ A force-pushed tag slipped past SHA-pinning, but cilock caught
  the credential theft at the kernel and the policy blocked it.

Your existing tools. Evidence you can inspect.

Start with a command you already run. Make its result available to the people and systems that need to verify it.

Keep the test result.

Capture evidence from your existing checks so reviewers can inspect what ran and what it returned.

Capture your first result →

Verify against requirements.

Evaluate the supplied evidence against a policy. Inspect the result before making a decision.

Understand verification →
The platform for developer and agent trust

One connected workflow. Three clear jobs.

CI/lock records the work. Use its evidence at a Pushgate checkpoint, then manage your gates and technical control evidence in the TestifySec platform.

CI/lock · You are here

Capture the work.

Capture signed evidence from builds, tests, and scans on your compute or hosted infrastructure.

Get started →
Pushgate

Check the push.

Require evidence before a push enters your repository through the gate.

Explore Pushgate →
TestifySec Platform

Manage gates. Reuse the evidence.

Manage repository gates and connect technical test results to compliance controls.

Explore the platform →

Platform capabilities, deployment options, and pricing live on testifysec.com. Find technical guides for all three products in the documentation hub.

Go deeper when you need to.

Open foundations.

CI/lock shares Witness’s attestation foundation and adds capabilities and commercial support from TestifySec. Compatibility depends on the evidence type.

Read the compatibility guide →

Understand the boundaries.

Learn what an attestation establishes, how policy verification works, and where your evidence sources matter.

Explore the evidence model →

in-toto is a trademark of The Linux Foundation.