For teams heading into SOC 2, ISO 27001, or SOX fieldwork
Find the change-control exceptions your auditor will sample — before they do.
Point changeproof at a repository and an audit period. It reads every pull request merged into your default branch in that window and gives you two things: the complete population of production changes, with a written statement of exactly how it was derived, and the exception register — every change that broke a change-control rule, linked to the pull request, naming the actor and the timestamp.
$299 for one audit period · read-only access · you keep the bundle
What lands in your inbox
The population
A complete, dated list of the changes that reached production in your window, and a plain statement of how that list was derived — so when the auditor asks “how do you know this is all of them?” you have an answer you can defend rather than a spreadsheet someone exported.
The exception register
The changes inside that population that broke a rule. Each row links back to the pull request and names the actor, the timestamp, and which rule it broke. No prose about your posture — just the rows, and a hash so you can show the bundle was not edited afterwards.
What counts as an exception
Merged without an independent approval
The author of the change also merged it, and nobody else approved. This is the segregation-of-duties finding a SOC 2 CC8.1 or SOX sample is built to catch.
Merged with zero approving reviews
The change reached the default branch with no approving review recorded on it at all.
Merged before the approval timestamp
An independent approval exists, but it landed after the merge — the change was already in when it was approved.
No linked issue — advisory only
Reported in its own section and never added to the exception count. It fires on teams that track work outside the issue tracker and on bot-authored changes, so folding it in would make a clean repository look broken.
Where GitHub does not record who merged a change — which happens with auto-merge — that change is reported as undetermined, never as compliant. An unknown is a thing to go and check, not a pass.
Two real repositories, measured on 2026-08-15
Both were run by the same pipeline your report comes from, against the live GitHub API. One has enforced independent review and comes back with nothing. The other is our own repository, which merges on green CI with no human approver.
facebook/react
A repository where independent review is enforced · branch main
- Changes in the population
- 53
- Exceptions
- 0
- Undetermined merge actor
- 0
Exceptions, by rule
- Merged without an independent approval0
- Merged with zero approving reviews0
- Merged before the approval timestamp0
Advisory — reported separately, never added to the exception count
- No linked issue reference35
Zero exceptions across all 53 changes. That is the result branch protection with required independent review produces, and it is worth paying for: the deliverable here is the defensible population and the written statement of how it was derived — which is what the auditor asked for in the first place.
markwhiting/workbot
Our own repository, which merges on green CI with no human approver · branch main
- Changes in the population
- 106
- Exceptions
- 185
- Undetermined merge actor
- 0
Exceptions, by rule
- Merged without an independent approval91
- Merged with zero approving reviews94
- Merged before the approval timestamp0
Advisory — reported separately, never added to the exception count
- No linked issue reference51
94 of the 106 changes reached main with no approving review, and 91 were merged by their own author with nobody else approving. Most changes broke both rules, which is why 185 exceptions sit on 106 changes. This is our own repository and we publish it because it is the honest end of the range: a small team that auto-merges on passing CI produces exactly this.
See the full report, including how these numbers were produced →
A clean result is still the thing you were asked for
Plenty of repositories come back with nothing. A team with enforced branch protection and required independent review returns zero — facebook/react did exactly that on our sample page. That is not a wasted report. The auditor’s request starts with a complete population of production changes and a defensible account of how it was derived, and that is what you hand over. We will never suggest that findings are universal, because they are not.
Common questions
What access do you need?
Read-only access to the repository's pull-request history. changeproof reads pull request numbers, titles, author and merge-actor logins, review states, and timestamps. It does not read, store, or transmit your source code.
What does “undetermined” mean on a row?
GitHub does not always record who merged a change — with auto-merge the merge can be attributed to the enabling actor or to nobody at all. When the merge actor is missing, the row says undetermined rather than guessing. Reading a missing actor as “no violation” would quietly turn a real finding into a pass, which is the worst thing an audit product can do.
What if my repository comes back clean?
Then you have the population and the derivation statement, which is the first thing the fieldwork request asks for, plus documented evidence that the sample the auditor is about to pull will not surprise you. A clean result is a completed report.
How is this different from a compliance platform?
Continuous-monitoring platforms report whether a control is configured today. changeproof reads the actual change history for the period being audited and returns the specific changes that broke the rule — early enough to remediate or disclose.
Can I re-run it every month?
Monthly re-runs are the next thing being built, so a self-approved merge surfaces in the week it happens rather than eleven months later. Today changeproof sells one audit period at a time; there is no subscription to cancel.
What's your refund policy?
Two conditions, both checked from our own records so you are never asked to prove anything. If the scan fails to finish after retries, or the bundle never reaches you, you are refunded — you can claim that for 90 days. If our logs show you never opened the delivered report, refunds are available for 30 days. A report that runs and finds nothing is a completed report, not a failure. Anything else, email changeproof@forage.bot.
Who is this NOT for?
Teams on GitLab or Bitbucket — only GitHub is supported today. Teams who need a formal assessment signed by an auditor; changeproof supplies the underlying record, it does not replace the audit. And teams already running a consultant-led evidence process they are happy with.