Solutions / Developers
Engineering teams own most of the controls auditors and customers ask about. Gorilli Compliance checks them in your repositories on every push and proposes fixes as pull requests.
Add the signed GitHub webhook and each push triggers a scan. New problems show up as findings marked new since the last scan.
Check branch protection, CODEOWNERS, SECURITY.md, dependency update settings, lockfiles, pinned actions, workflow token permissions and committed secrets.
Open a pull request with the fix or guidance for supported findings and merge it like any other change.
Owners and admins get an email when a check that was passing starts failing, so a broken control does not wait for the next audit.