CRACI vs Legit Security

The short answer

Legit Security is an application security posture management (ASPM) platform. It connects to your source control, CI, registries and scanners, maps your software development lifecycle, enforces policies across it, and pulls security findings into one prioritized view. CRACI is a GitHub Actions runner that records what each build pulls in, controls what the build can reach, signs provenance for the result, and keeps monitoring what shipped. Legit governs the pipeline from the outside; CRACI is the pipeline's execution layer. Both sell to teams with a "secure our software supply chain" mandate, and some teams will want both.

At a glance

What Legit Security does well

Seeing the whole SDLC. Legit's software supply chain security product aims to "discover and correlate your entire SDLC automatically", keeping a continuously updated inventory of SDLC assets and the security controls on them, with visual models of systems and pipelines. For a security team that inherited hundreds of repositories and several CI systems, that map is valuable on its own.

Policy across many systems. Legit says it enforces hundreds of policies to secure SDLC systems, CI/CD pipelines, code and teams. Its integrations list is broad: GitHub, GitLab, Bitbucket and Azure DevOps for source control; GitHub Actions, GitLab CI, Jenkins, CircleCI, TeamCity and others for CI; container and package registries such as JFrog Artifactory and Sonatype Nexus; and cloud platforms.

One view of findings. Legit orchestrates existing scanners such as Snyk, Checkmarx, Veracode and GitHub Advanced Security, then correlates and de-duplicates their findings. It also offers native SAST and SCA, with reachability analysis and license risk detection added in 2025.

Secrets and AI-generated code. Its secrets detection reaches beyond source code into Git history, build logs and shared workspaces such as Slack, Confluence and Jira. VibeGuard brings its checks into the IDE for AI-generated code. Legit also publishes Legitify, an Apache 2.0 open-source tool that finds insecure GitHub and GitLab settings.

SBOMs and attestations. Legit creates SBOMs and signed software attestations and supports compliance reporting against frameworks including ISO 27001, SSDF, SLSA, NIST, SOC 2 and PCI DSS.

Where CRACI is different

A posture platform reads configuration and scanner output through APIs. It can tell you that a pipeline is set up in a risky way. It cannot see the network traffic of a job while it runs, because it is not the machine the job runs on. CRACI is.

The build is the source of truth

Your workflow moves to CRACI with a one-line change to runs-on. A package-aware proxy then records what each job downloads from package sources across npm, PyPI, RubyGems, Cargo, Go, Nix, OCI and OS packages, and packages restored from CI caches are carried forward. Each SBOM states how complete it is, per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. The SBOM describes what the build fetched, not what a manifest says it should have fetched.

Control, not just visibility

An egress policy at the runner decides which hosts a job may reach. Policies are default deny or default allow, with 24 built-in software-source presets and typed custom sources. They are validated before the job starts, fail closed, and send an email alert on a violation. A posture finding tells you to fix a setting; an egress policy stops the connection while the build runs.

Evidence tied to the artifact

Signed provenance (Ed25519 over SHA-512) links each artifact, including OCI artifacts, to the build that produced it. Through the API you can trace an artifact to its build, its CycloneDX SBOM and the job network trace. CRACI keeps re-evaluating monitored SBOMs as new vulnerabilities are published, and aggregates findings across builds and repositories.

What CRACI does not do matters here too. It has no SAST, no secrets scanning, no SDLC inventory and no scanner aggregation, and it supports GitHub Actions only today.

Which one fits, and when to use both

• You run many SCM and CI systems and need one governance layer. Legit. Its breadth across GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins and more is the point.
• You need proof of what went into each release. CRACI. The record comes from the runner, with a completeness state and signed provenance.
• A compromised package tries to phone home during a build. CRACI's egress policy blocks connections outside the allowed sources. Legit's ad hoc queries against your SDLC help with the investigation that follows.
• You already run Legit and build on GitHub Actions. Keep Legit for posture, secrets and findings. Move the builds you ship to CRACI runners so the SBOM, provenance and network record come from the build itself.

For the CRA

The Cyber Resilience Act asks manufacturers to document the components in their products, including an SBOM, and to handle vulnerabilities for as long as a product is supported. Reporting of actively exploited vulnerabilities applies from September 2026. Legit helps by governing the development process and reporting on security posture. CRACI helps by producing per-build evidence of what went into each release, with provenance, ongoing monitoring and report export in PDF, HTML, CSV, Excel and JSON. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process; neither tool makes a product compliant on its own. Read what the CRA requires and how CRACI supports CRA compliance.

Adding CRACI alongside Legit Security

Set runs-on: craci on the workflows that build what you ship. CRACI replaces the runner, not GitHub Actions, so the repositories and workflows stay in GitHub and runs still appear in the GitHub UI. CRACI exports SBOMs in CycloneDX and SPDX for any tool that takes them. Teams on GitLab, Jenkins or Azure DevOps pipelines would need to move those builds to GitHub Actions to use CRACI runners. Learn more about build-time SBOM generation and CI/CD integration.