A code host where a mistake is not fatal.

Default-safe, not opt-in-safe

Every host stores git. Almost none make the unsafe path the one you have to choose. TillForge inverts that: the protections a beginner would forget to enable are on from the first push, and an expert can tune them.

• Secrets can’t leak. The push boundary scans every introduced blob and rejects the push — with file and line — so a credential never enters history or the reflog. It fails closed: if the scanner can’t run, the push is refused, not waved through. See Branch protection.
• No mistake is fatal. The default branch is protected against force-push and delete, and a server-side reflog keeps recently-orphaned commits — so a deleted branch or a force-pushed-over ref is a one-click restore, not a lost afternoon.
• Sovereign by construction. Code never leaves your infrastructure except where you explicitly send it — a mirror you configure, or an AI call you authorize through the egress boundary. Air-gapped operation is a supported mode.

The promise isn’t “we host your code” — it’s “a master coder is fully covered and a beginner’s mistake is not fatal.”

One boundary, both transports

TillForge owns the push boundary. Whether a push arrives over HTTPS or SSH, it passes the same pre-receive policy — secret-reject, branch policy, commit-identity check — before a single ref moves. Only a clean, authorized push lands.

   your editor · CI · terminal agent
        │  git over HTTPS (tfp_ token)  or  SSH (registered key)
        ▼
 ┌──────────────────────────────────────────────────┐
 │  push boundary   (pre-receive · fails closed)      │
 │  secret-reject · branch policy · commit identity   │ ◀─ every push,
 └───────────────────────┬────────────────────────────┘    both transports
                         │  only a clean, authorized push lands
                         ▼
   your repositories   (org-isolated · encrypted at rest)
        │                              │
        ▼                              ▼
   history & recovery            AI egress boundary
   reflog · one-click restore    default-deny · redact · audit

Two front doors reach the same repos: git (clone / fetch / push, authenticated by a tfp_ token or an SSH key) and the dashboard & CLI (session or token auth) for policy, PRs, findings, and recovery. If the dashboard can’t be reached, git clone and git push keep working for up to 72 hours on a signed copy of access and branch protection, as long as the git server itself doesn’t restart. More in Repositories.

What's on by default

These defaults ship active on every repo — you don’t configure them to be safe, you configure them to be less strict when you have a reason:

Security is the spine, not a section

A code host is the place a supply-chain attack lives — the source is the asset and the signing keys are a harvest-now, decrypt-later target. TillForge is designed accordingly: whole weakness classes are made absent by construction rather than patched instance by instance.

• No shell string is ever built from input — command injection is structurally unreachable; the git server executes argv arrays only.
• Outbound connections can’t be turned inward — a mirror reaches only public addresses, checked on the address it actually connects to, over https with no redirects; webhooks are checked before every delivery and never follow a redirect; model calls go to fixed provider endpoints.
• The on-disk repo path is derived from opaque ids, never a user string, and one org’s objects are unreachable from another’s.

The full posture — sovereignty, the push boundary, AI egress governance, recoverability, and the CWE coverage map — is one screen: Security.

What's in the box

• Quickstart — create a repo, mint a token, clone and push over HTTPS from any editor, watch a secret get rejected.
• Repositories — create, clone, and push over HTTPS + SSH; the clone URL and tfp_ token flow; browse code, history, and blame.
• Access & tokens — tfp_ tokens, SSH keys, and the owner / admin / developer / viewer roles that govern git and the API.
• Branch protection — protected branches, secret-reject-at-push, and one-click reflog recovery — the security wedge.
• Pull requests — reviews, the merge gate, the checks / status API, and CODEOWNERS.
• Code search — literal, line-numbered search across a repo at any revision, from the CLI or the Code tab.
• CI & runners — self-hosted continuous integration whose checks feed the merge gate, on runners you own.
• Releases & builds — tagged releases with a generated changelog and a checksummed build per platform.
• Deployments — preview before production, with an approval gate and commit-pinned crash correlation.
• Events & webhooks — signed webhooks for your pipeline and personal notifications for your work.
• Security — the posture: sovereignty, the push boundary, AI egress governance, and recovery.
• Code scanning — security flaws in every push’s source, mapped to CWE, OWASP and MASVS; warn, or block the merge.
• IaC scanning — Terraform, CloudFormation and Kubernetes files judged by the cloud posture checks, so a misconfiguration is caught before it deploys.
• Build provenance — signed SLSA statements for every CI build’s outputs, so anyone can check where a file was built.
• Source track — each protected-branch update graded against SLSA Source levels and signed, so anyone can check how a commit reached the branch.
• Supply chain — which checks cover each repository, and a deploy policy that holds a deploy on what they found.
• CLI reference — every tilldev forge command.