Zero Repo Tokens Held · GitHub Actions OIDC · Ed25519 Signed PDFs

Turn raw GitHub fix history into human-reviewed, signed Evidence Packs.

Your CI runs the free itulo/fixdossier@v0 GitHub Action and uploads security-record.json using a short-lived GitHub Actions OIDC JWT. In fixdossier Pro, your engineering team reviews each security fix, records rationale & sign-off into an append-only hash-chained audit log, and exports multi-page Ed25519-signed PDF + ZIP Evidence Packs for customer questionnaires and technical reviews.

Launch Interactive Demo (acme/payments-api) → Sign in with GitHub Founding Licence · €69 once (50/50 left)

GitHub OAuth is active. Sign in with your GitHub account to access your organization workspace.

Zero-Secret Architecture

Step 1 · Collect in CI

Upload via GitHub OIDC

Your workflow requests a short-lived OIDC token from https://token.actions.githubusercontent.com and POSTs the fixdossier/v1 snapshot to /api/v1/ingest. We never hold tokens to your repositories and never see source code.

Step 2 · Human Sign-Off

Review Queue & Audit Log

Distinguish advisory-derived fixes from commit/bot heuristics. Mark items as confirmed_security_fix, excluded_not_security, or needs_followup with reviewer attribution and UTC timestamps in an append-only ledger.

Step 3 · Export & Verify

Signed PDF + ZIP Bundle

Generate Draft or Final packs containing the multi-page PDF report, security-record-reviewed.json, SUPPORT.md, and pack-manifest.json signed with Ed25519 (verifiable at /api/v1/verify).

Founding Licence · First 50 GitHub Orgs 50 of 50 remaining

€69 one-time + VAT via Dodo Payments

Active for as long as the service runs — no recurring annual fee. Includes at least 90 days' notice + 1-click full org export on shutdown (no refund on shutdown) and a 14-day no-questions-asked purchase refund window.

1 GitHub organization (bound to immutable numeric GitHub org_id — cannot be shared across orgs)
Up to 3 products / repositories & 5 reviewer seats (unlimited read-only viewers)
Up to 24 Final Evidence Packs / year & 60 Draft PDFs / month
Fair-use ingestion: up to 300 uploads / month (max 5 MB per fixdossier/v1 snapshot)
1-click Full Org Export (/app/export.zip) of all snapshots, reviews, audit events, and packs at any time

Buy Founding Licence (€69) Try Demo First

After the first 50 organizations: regular plan placeholder at €99/org/year. Hosted in the EU (Hetzner).

CI Ingestion Snippet & Ed25519 Verification Key

Add OIDC upload to your GitHub Actions workflow:

permissions:
  contents: read
  pull-requests: read
  security-events: read
  id-token: write

steps:
  - uses: itulo/fixdossier@v0
    with:
      pro_upload: 'true'

Active Ed25519 Signing Key ID: ed25519:0961c15ac1deac6c

Public Key (Hex): 0961c15ac1deac6cf20bf3671905c1e7a14d38b0813604aeb377a8a1b3a408da

Verify any pack-manifest.json via POST https://app.fixdossier.dev/api/v1/verify.