Gitfed
security model

Why it's secure, explained simply

No unnecessary jargon: here's, step by step, how Gitfed protects your code — from transport to your collaborators' identity.

01 · transport

SSH only, never git over HTTP

Gitfed exposes no git-over-HTTP protocol. Every read or write goes over SSH — a protocol proven for 25 years, with a single door to watch instead of two.

git clone/push SSH :2222 gitfed-server SSH — open HTTP git — doesn't exist repos bare git
A single network entry point for git: the SSH port.
02 · identity

Short-lived certificates, not shared passwords

Every instance generates its own certificate authority. Your instance signs a certificate proving who you are, valid for 24h by default — never a long-lived secret that can leak.

alice has an SSH key 1. requests alice's instance local authority (CA) signs 24h 2. certificate bob's instance does it trust this CA? access verification is 100% local from here — no network call on every push
alice asks her own instance for a certificate, presents it to bob's, which checks its trust in alice's instance.
03 · trust

Trust between instances is explicit, never automatic

The first time an unknown instance shows up, Gitfed reads its public profile (/.well-known/gitfed.json) then puts its key on hold — an admin has to approve it before any access is granted. Discovery is also capped at 10 new domains per minute, to prevent abuse.

Unknown domain contacts your instance Discovery reads its public CA key Pending until an admin acts Approved an admin's decision
04 · isolation

Web access and git access share nothing

The web UI password has nothing to do with your git access: it's hashed (bcrypt), never stored in clear text, and only opens an opaque, time-limited web session. A `git push` never depends on this password — only on your SSH key or certificate.

Precise per-repo roles — read, write, admin — never all-or-nothing.
Public ≠ writable — a public repo opens for reading, never for writing without an explicit grant.
Session cookies — HttpOnly, Secure, SameSite — unreachable from JavaScript.
Audit log — every access decision, allowed or denied, is recorded.