NDSS 2025 – Rethinking Trust In Forge-Based Git Security

This NDSS 2025 session overview presents gittuf, a system that decentralizes Git security on forges (e.g., GitHub, GitLab, Bitbucket) by distributing policy declaration/management, decentralizing repository activity tracking, and enabling independent policy verification by all developers; designed to withstand forge or privileged account compromise, it protects branches, tags, and file paths from unauthorized changes and demonstrates viability on large projects like Git and Kubernetes with under 4% storage overhead and roughly 0.59s verification time per push.