Signed Commits: 1 issue found

[hekkos-app]

Hekkos found 1 Signed Commits configuration issue in this repository.

_{This is part of the main security audit.}

Issue details

• Issue 1: Signed commits are not required - commits can be forged or impersonated

---

Why this matters

Commit signing provides cryptographic verification of commit authorship. This offers:

• Assurance that commits came from who they claim to be from
• Protection against commit forgery (though git config can still be spoofed)
• A verifiable audit trail of code changes
• Defense against certain account compromise scenarios

---

How to fix

1. Set up GPG or SSH commit signing for your account
2. Configure Git to sign commits automatically
3. Enable branch protection to require signed commits

Documentation:

• About commit signature verification
• Signing commits