macOS
Homebrewverified · 100%
brew install legitifylocal Homebrew formula metadata
brew / rank 7761
Install legitify with Homebrew, Nix
Tool to detect/remediate misconfig and security risks of GitHub/GitLab assets. Version 1.0.11 via Homebrew; verified 2026-07-26. Also installable with nix: nix profile install nixpkgs#legitify.
install
Additional install commands
Linux
Nixverified · 92%
nix profile install nixpkgs#legitifynixpkgs package indexes · pkgs/by-name/le/legitify/package.nix · source: api.github.com
overview
Package summary
Tool to detect/remediate misconfig and security risks of GitHub/GitLab assets
Project links
Commands and aliases
- legitify
history
Project history and usage
Legitify is Legit Security's open-source CLI for finding and helping remediate security, compliance, and misconfiguration risks across GitHub and GitLab assets.
Project history
Legit Security announced Legitify on 2022-10-05 as an open-source GitHub configuration scanner for security, DevOps, and developer teams. The repository and project site later described the scope as source-code-management posture across GitHub and GitLab assets, with built-in policies and remediation-oriented output.
Adoption history
The project was packaged as a standalone CLI, GitHub Action, Homebrew formula, Nix package, and GitHub CLI extension. That mix made it fit both one-off audits from a workstation and scheduled checks in CI for organizations managing many repositories, members, teams, runners, branch protections, and tokens.
How it is used
Typical usage is to authenticate to GitHub or GitLab, run `legitify analyze`, and review policy findings against repositories, organizations, runners, webhooks, actions, branch protection, and other SCM resources. Its Homebrew packaging matters because security teams can hand developers a familiar install path instead of a vendor-only SaaS workflow.
Why package nerds care
Legitify is a package-nerd example of application-security posture management ideas escaping into a plain CLI. It packages policy checks and remediation hints as a tool that can live in local shells, CI jobs, and GitHub Actions, adjacent to linters and secret scanners.
Timeline
- 2022-07-26: The GitHub issue tracker showed early public project activity.
- 2022-10-05: Legit Security published the introductory Legitify announcement.
- 2023-01-19: Public issues tracked expansion into third-party application policies.
- 2023-02-06: Public issues tracked auto-remediation work.
Related projects
- Related projects include the `gh-legitify` GitHub CLI extension, the Legitify GitHub Action, OpenSSF Scorecard, GitHub Advanced Security configuration checks, GitLab security scanners, and policy-as-code tools used for SCM governance.
Sources
security posture
Risk level: blue
broad file, network, media, or database tool signal.
Risk classifier
blue risk · medium confidence · tool
Why
- broad file, network, media, or database tool signal
Signals
- text:media
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
legitify | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version1.0.11
manager updated2026-07-26
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:legitify |
|---|---|
| Version | 1.0.11 |
| Package manager | Homebrew |
| Homepage | https://legitify.dev/ |
| Repository | https://github.com/Legit-Labs/legitify |
| Last updated | 2026-07-26T13:41:01+02:00 |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Nix95%
legitify
nix profile install nixpkgs#legitify- normalized package name match
- Matched by: Legitify
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- pkg.so package database
- pkgdb category and tag curation