Re:GitHub Is Down
by onraglanroad on Monday February 09, 2026 @12:15PM
(#46947866)
The Linux kernel uses an email based workflow. You can digitally sign email and add it to an immutable store that can be reviewed.
Does SOC2 itself require that or just yours? I'm not too familiar with SOC2 but I know ISO 27001 quite well, and there's no PR specific "requirements" to speak of. But it is something that could be included in your secure development policy.
Re:GitHub Is Down
by badgersnake on Monday February 09, 2026 @01:31PM
(#46948956)
Yeah, it’s what you write in the policy.
Re:GitHub Is Down
by swiftcoder on Monday February 09, 2026 @01:34PM
(#46948988)
And it's pretty common to write in the policy, because its pretty much a gimme, and lets you avoid writing a whole bunch of other equivalent quality measures in the policy.
Every product vendor, especially those that are even within a shouting distance from security, has a wet dream: to have their product explicitly named in corporate policies.
I have cleaned up more than enough of them.
Our SOC2 doesn't specify GitHub by name, but it does require we maintain a record of each PR having been reviewed.
I guess in extremis we could email each other patch diffs, and CC the guy responsible for the audit process with the approval...