Legitify

Legitify strengthens the security posture of your source-code management. It is a command-line tool that detects and remediates misconfigurations, security issues, and compliance gaps across your GitHub and GitLab assets, checking organizations, repositories, members, actions, and runner groups.

You can scope analysis by namespace, organization, repository, or enterprise, and archived repositories are skipped by default. Results print as human-readable text, JSON, or SARIF, and can be grouped by namespace, resource, or severity. Flags let you show only failed checks and ignore selected policies. Optional OSSF Scorecard support alerts on GitHub repositories scoring below 7.0.

It works against both GitHub and GitLab, with --scm gitlab required for GitLab. Install it with Homebrew, as a GitHub CLI extension, or from source, and run it in CI with the official GitHub Action.