Free Verify scan · PostHog/posthog

posthog scores 80/100

Product analytics, session replay, and feature flags.

Commit cff4875 · 132 controls · Oct 16, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score80

posthog

42median 6886

Out of 100. Stronger than 94% of the 68 other assessed repositories.

Score

80/100

Rank 3 of 69 · median 68

Gaps

10 fewer than the median of 33

Critical

3 controls

1 root cause

Not visible

Needs admin access

What posthog does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetForce-push restrictedPull-request requirement on default branch

Gaps23

posthog

15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 87% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in posthog's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

Governance leads the assessment.

9 of 10 visible controls pass in governance.

Review has the most room to improve.

7 visible controls remain open in review.

Priority

Fix these first

critical

Production approvers named

Covers 3 controls

Production approvers named
Production protection
Production reviewers resolved

What Verify read

No resolved production reviewers.

Risk: Unnamed production approvers mean deployment approval falls to whoever is nearby when the button needs pressing.

text

Name production reviewers.

Have this gap too? Start from the PR Review Pipeline flow.

Open in Design

high

Stale reviews dismissed

Covers 1 control

Stale reviews dismissed

What Verify read

Dismiss stale: false

Risk: Approvals that survive a new push mean the merged code is not the code anyone approved.

text

Dismiss stale reviews.

high

Last-push approval required

Covers 1 control

Last-push approval required

What Verify read

Last-push approval: false

Risk: A final push after approval can introduce anything, and the merge still shows a green review.

text

Require last-push approval.

Overview

Control map

Public-access limit

18 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

No unattended prod migrationcritical
Administrator bypass restrictedhigh
Tag protectionhigh
Self-merge restrictedhigh
Bypass actors justifiedhigh
Push protection enabledhigh
Dependabot alertshigh
Secret scanning alertshigh
SAST required on default branchhigh
Environment secrets scopedhigh
Secret custodiansmedium
Actions run history readablemedium
Check runs readablemedium
Agent identity in commitsmedium
Audit of agent actionsmedium
Audit of privileged actionsmedium
Private vulnerability reportinglow
Wait timer or freeze windowlow

Get Verify

Method

How Verify works

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

	This free scan	Verify on your repository
Access	Public	GitHub App you install
Controls read	113 of 116	All 116
Private repositories	No	Yes
Results	Published here	Private to your organization

Evidence locker

Every control Verify checked

Governance

9 of 12 pass

Review

16 of 26 pass

CI & tests

24 of 30 pass

Code quality

6 of 8 pass

Security

12 of 20 pass

Agents & AI

5 of 8 pass

Release & ops

13 of 22 pass

Docs

5 of 6 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 89Oct 16 · 80

Oct 16, 2026Actions run history readable · CI & tests — confirmed → could not be readcff4875
Oct 16, 2026Check runs readable · CI & tests — confirmed → could not be readcff4875
Oct 16, 2026Audit of agent actions · Agents & AI — needs repository admin access → could not be readcff4875
Oct 12, 2026Actions run history readable · CI & tests — could not be read → confirmed34a467e
Oct 12, 2026Check runs readable · CI & tests — could not be read → confirmed34a467e
Oct 12, 2026Audit of agent actions · Agents & AI — could not be read → needs repository admin access34a467e
Oct 7, 2026Actions run history readable · CI & tests — confirmed → could not be read17df776
Oct 7, 2026Check runs readable · CI & tests — confirmed → could not be read17df776
Oct 7, 2026Audit of agent actions · Agents & AI — needs repository admin access → could not be read17df776
Oct 5, 2026SBOM or dependency graph · Security — needs repository admin access → confirmed084a506
Oct 3, 2026SBOM or dependency graph · Security — confirmed → needs repository admin access93e9f0e
Sep 28, 2026SBOM or dependency graph · Security — needs repository admin access → confirmed01cf0e3
Sep 25, 2026SBOM or dependency graph · Security — confirmed → needs repository admin access8ff2cf4
Sep 23, 2026SBOM or dependency graph · Security — needs repository admin access → confirmedd9a5c14
Sep 21, 2026Delivery controls score 89 → 8034b293c
Sep 21, 2026Security policy · Review — could not be read → gap34b293c
Sep 21, 2026On-call or incident owner · Review — could not be read → gap34b293c
Sep 21, 2026Typecheck command · CI & tests — could not be read → gap34b293c
Sep 21, 2026E2E or integration tests · CI & tests — could not be read → gap34b293c
Sep 21, 2026Coverage gate · CI & tests — could not be read → gap34b293c
Sep 21, 2026Secret patterns in lint · Code quality — could not be read → gap34b293c
Sep 21, 2026Security policy · Security — could not be read → gap34b293c
Sep 21, 2026Agent identity in commits · Agents & AI — could not be read → needs repository admin access34b293c
Sep 21, 2026Agent workflow permissions · Agents & AI — could not be read → gap34b293c
Sep 21, 2026Rollback path · Release & ops — could not be read → gap34b293c
Sep 21, 2026Backup or restore note · Release & ops — could not be read → gap34b293c
Sep 21, 2026On-call runbook · Release & ops — could not be read → gap34b293c
Sep 21, 2026Threat or trust notes for agents · Docs — could not be read → gap34b293c

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo free See how your team scores

Read-only access. No code stored. How Canon handles your data →

View PostHog/posthog on GitHub

Maintain posthog? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.