Everything we've
shipped and what's next.
A complete directory of every GitStache feature: live today, actively building, and planned for the road ahead. Updated every time something ships.
Built around the problems GitHub still wrestles with.
Zero-trust CI by default
Jobs run locked down by default: no cluster credentials, no network egress, and Sigstore-signed provenance, opt-in per repo. Per-job Firecracker microVM isolation and SPIRE workload identity are next on the funded roadmap.
Stack-aware merge queue
Coming: one CI run per stack. Binary-search failure isolation will pin the exact bad layer, and speculative parallel execution will keep every stack moving without waiting in line.
Large-diff performance
Virtualized rendering keeps 50k-line diffs fully interactive at under 100ms first paint with a capped memory ceiling -- no more browser freezes.
Triage as a work queue
Your turn and Following, split apart, so a zero badge is a promise you can trust. No more notification waterfalls and zero-count inboxes you are afraid to open.
Service isolation
Web, git data, and CI planes are separated. A CI outage never takes down your code browser. Each plane degrades gracefully and independently.
Where we are in the build.
- 01
Phase 1
CompleteShipped the foundation: repositories, branches, issues, flat PRs, code review, SSH and HTTPS transports, Keycloak and OpenFGA auth, hardened namespace-isolated CI runners, Sigstore artifact signing, the self-hosted appliance, GitHub importer, and bundle export.
- 02
Phase 2
ActiveBuilding the differentiators: stacked PRs as a first-class primitive, diff virtualization for 50k-line diffs, the stack-aware merge queue, the Attention Inbox whose-turn rollup, realtime updates via SSE, automated CD, file editing, embeddable stack badges, Stripe billing, SCIM provisioning, and WorkOS enterprise multi-tenancy.
- 03
Phase 3
PlannedPer-job Firecracker microVM isolation with SPIRE workload identity (funded roadmap, fenced post-MVP by ADR-0071), planning primitives, OCI registry, social and discovery surfaces, enterprise polish, mobile app, the gs CLI and TUI, and IDE extensions.
Every feature, every status.
Showing 147 features
Repository creation and management
Create, configure, and transfer repositories in seconds from the web UI, with org and team ownership baked in from the start.
Repository browser and file viewer
Browse source with Shiki-powered syntax highlighting across 25 languages. Every file renders beautifully at any depth.
Git push and pull over SSH (port 22)
Use standard SSH keys for git operations on the default port. PAT and SSH-key auth both work out of the box.
Git push and pull over HTTPS
Push and clone over HTTPS with standard git credential helpers. Works everywhere SSH is blocked.
Repository forking
Fork any repo and maintain an independent downstream history. Full git parity, including divergent branches and cross-fork PRs.
Branch listing and management
See all branches at a glance, set protection policies, and keep your default branch locked against force-pushes.
Release and tag management
Publish versioned releases with attached artifacts and tags. Download links and release notes in one place.
Commit history browsing
Walk the full commit log with message search, author info, and one-click diff navigation for every SHA.
Branch protection policies
Require passing CI checks and minimum approvals before merge. Block force-pushes and lock your default branch automatically.
Blame and line-level code history
Find exactly who changed which line and why. Every line will link back to the commit that introduced it.
Repository settings
Control visibility, description, and default branch from one settings page per repo.
Private and public visibility control
Flip a repo public or private at any time. Public repos are readable by anyone without login.
Automatic language detection
Repositories show a language breakdown automatically. No configuration needed.
Contributor tracking
See top contributors with commit counts and attributions. Recognize the people driving your project forward.
Full-text code search
Repo-name search is live today. Full-text search across code content, with regex and literal patterns, is on the roadmap.
Pull request creation (including draft PRs)
Open PRs instantly from any branch. Draft PRs let you share work-in-progress before it is ready for formal review.
PR listing and filtering
Filter by open, merged, or closed state and sort by date, activity, or review status. Find any PR in seconds.
Diff rendering with syntax highlighting
Every diff is syntax-highlighted line by line. Binary files are detected and presented without garbling the output.
Virtualized diff for very large changesets
Scroll through 50k-line diffs at under 100ms first paint. The heap stays capped so your browser never freezes.
Review threads and inline comments
Leave inline comments on any line, reply to threads, and delete resolved notes. The full conversational review experience.
Code suggestions in review
Propose an exact code change directly in a review comment, for the author to apply with one click. On the roadmap.
Approval workflows
Configure how many approvals a branch requires before merge. Configurable per branch, enforced at the gate.
Async merge with state-machine orchestration
Merges are non-blocking. The server orchestrates the rebase-and-merge sequence so your UI stays responsive.
Merge confirmation with 30-second undo window
A 30-second undo window after merge catches accidental clicks before the branch lands.
Durable review composition (server-persisted drafts)
Review drafts survive tab crashes and reconnects. Your in-progress review is never lost.
Keyboard-first review navigation
Move between files and hunks with keyboard shortcuts that do not collide with browser defaults. Review without touching the mouse.
CODEOWNERS review routing
Automatically route reviews to the right people based on your CODEOWNERS file. Never wonder who should review what.
File-level diff comments
Leave high-level feedback on an entire file, not just a single line. Useful for architecture and structure comments.
Reviewer suggestions
Get suggested reviewers based on file history and CODEOWNERS. Pick from a ranked list instead of guessing.
Audit-logged admin override for the required-checks merge gate
Repo admins and org owners can override a failed required-status-checks gate with a full audit log entry. Unblocks legitimate merges without disabling branch protection.
PR conversation thread
Post and reply to a plain, PR-level comment thread, not just a one-shot review verdict. Notifies the author, requested reviewers, and anyone @mentioned, and puts the ball in their court.
Stack creation (named stacks with layers)
Group related PRs into a named stack. Each layer is an independent PR that can be reviewed and approved in isolation.
Stack viewing and navigation
See the full stack at a glance: layers, metadata, and per-layer status in one unified view.
Per-layer status and approval
Each layer tracks its own approval and CI state independently. Merge layer by layer at your own pace.
Stack-aware review routing
Assign reviewers per layer so the right expert sees only the code that is relevant to them.
Cascading rebase across layers
Rebase one layer and the cascade propagates automatically to every dependent layer, with every layer's ref genuinely moving. No manual rebase chain.
Dependent merge policies (in-order, no skipping)
Layers merge in order. Out-of-order merges are blocked structurally so dependent code never lands before its dependencies.
Full stack lifecycle, verified in production
From a git push to a merged stack: author layers, review each one independently, and merge bottom-up through the one door, with the cascade rebasing every layer above and re-running CI automatically after each merge.
Stack-aware merge queue
One CI run per stack, binary-search failure isolation to find the bad layer, and speculative parallel execution to keep throughput high. On the roadmap, gated on a 30-day pilot that has not yet run.
Embeddable stack badge and graph
Embed a live stack graph anywhere: README files, wikis, dashboards. Served as a public SVG or iframe.
Stack list and delete (full lifecycle management)
List all stacks for a repo, navigate between them from the repo sidebar, and delete stacks you no longer need. Full create-to-close lifecycle from the web UI.
gs stack CLI (create, list, manage)
Create a stack and file layers from the terminal without leaving your editor. Approving, merging, and rebasing a layer still need the web UI for now.
Issue creation and editing
Create and edit issues with labels, multiple assignees, and full Markdown support. Everything you need to track work.
Issue listing and filtering
Filter by status, assignee, label, and date. Find the issue you need without scrolling through noise.
Labels and label management
Create custom labels with any color to categorize issues your way. Consistent labeling across the whole repo.
Issue comments and threading
Threaded discussions keep context in the right place. Collaborate on issues without losing the thread.
Issue assignment to multiple people
Assign any number of people to an issue so ownership is always explicit.
Markdown rendering (sanitized)
Full Markdown with sanitized output across issues, PRs, and comments. Safe to render without worrying about XSS.
Issue close with 30-second undo
Close an issue and take it back within 30 seconds if you change your mind. No accidental permanent closures.
Attention Inbox: two-lane whose-turn work queue
Your turn and Following, split apart. A zero in Your turn is a promise, not a guess -- clearing an update reads your activity, but the review still owes you until you say so. Reason chips, age-on-you, and a "layers blocked" count for stacked PRs surface exactly what GitHub cannot show.
Clear updates, resolve, and bulk-clear
Mark a thread's activity read without dropping it from Your turn, or resolve it outright with Not my turn. Clear everything in Following with one click when you are caught up.
Priority lanes with drag-and-drop reorder
Drag items into priority lanes so your top work will surface at the top of your queue every time. On the roadmap, fenced post-MVP.
Duplicate detection and merge
Merge duplicate issues to a canonical one automatically, keeping the tracker clean without manual housekeeping. On the roadmap.
Public project index at /explore
Discover public projects with a searchable, SEO-friendly index. Your open-source work is findable from day one.
OIDC and SSO via WorkOS AuthKit
Sign in with Google, GitHub, Apple, or corporate SAML. One auth flow, every identity provider.
Email and password signup and login
No OAuth provider required. Sign up with an email and password and get going immediately.
Keycloak identity for self-hosted deployments
Self-hosted installations use Keycloak so you control your identity store completely. No cloud dependency required.
Email verification with resend support
Verify your email address to unlock the full product. Resend the verification link any time if it gets lost.
Secure session management
Sessions use HTTPOnly, Secure, and SameSite cookies. Your auth cookie is never accessible to JavaScript.
Personal access tokens (scoped, create and revoke)
Create scoped API tokens for scripts and CI. Revoke any token instantly when it is no longer needed.
SSH key management
Add, list, and remove SSH keys from your account. Multiple keys per user for multiple machines.
Account profile and settings
Update your name, email, avatar, and password in one place. Your profile is always yours to control.
Account deactivation
Deactivate your account to revoke all sessions, PATs, SSH keys, and access in one action.
CSRF protection (double-submit tokens)
Every state-changing request is protected by a double-submit CSRF token. Cross-site request forgery is blocked structurally.
gs CLI device-code login
Authenticate the gs CLI via a browser-based device code flow. No copy-pasting tokens from a settings page.
GitStache-owned login and signup UI (no hosted redirect)
Login, signup, password reset, and SSO initiation run on the GitStache domain with a fully owned UI. No redirect to a third-party auth page, no $99/mo custom-domain fee.
OpenFGA relationship-based access control
Permissions are modeled as relationships, not flat roles. Org, team, repo, and branch access all flow from a single source of truth.
Org, team, and repo hierarchical permissions
Grant access at the org level and narrow it per team or repo. No duplicate permission grants across the hierarchy.
Role levels (Guest, Reporter, Developer, Maintainer, Owner)
Familiar role names with clear capability boundaries. Assign the right level once and the system enforces it everywhere.
Collaborator management (admin, write, read)
Add collaborators to a repo with a specific access level. Remove or change access any time without affecting the org.
Team administration
Create teams, add members, and assign repo access at the team level. Onboarding new engineers takes minutes.
Service-account model for CI and CD
CI and CD pipelines run as service accounts with minimal scoped access. No human credentials in pipelines.
Last org-owner protection
The last owner of an org cannot be demoted or removed. Your organization is never left without an admin.
CI run creation (push and PR triggered)
CI fires automatically on every push and PR. You never need to manually trigger a run.
CI status tracking on PRs
See CI state directly on the PR: pass, fail, and in-progress, all linked to the run detail.
Live CI step progression
Watch CI steps update in real time. No page reloads, no guessing when the run will finish.
Branch-protection status checks
CI results block merge automatically when branch protection rules require passing checks.
GitHub Actions-compatible YAML (secrets, env, matrix)
Your existing Actions workflows run without modification. Secrets, environment variables, and matrix builds all work.
Hardened namespace-isolated CI runner
CI jobs run on-host inside a locked-down namespace: restricted Pod Security Admission, default-deny egress plus an egress forward-proxy allow-list, gVisor (runsc) sandboxing, and no service-account token. Opt-in per repo.
Firecracker and Kata ephemeral per-job microVM runners
Each CI job will get its own fresh microVM so jobs cannot read each other's files, memory, or network state. Funded roadmap item, fenced post-MVP by ADR-0071.
SPIRE workload identity (short-lived per-job credentials)
Every CI job will receive a short-lived SPIRE-issued identity, removing long-lived secrets from the environment. Funded roadmap item, fenced post-MVP by ADR-0071.
Sigstore Cosign artifact signing and verification
Build artifacts are signed with Cosign and stored with a verifiable provenance record. Trust what you ship.
Zero-trust fork-PR isolation
Fork PRs run without access to repo secrets. Contributors from the open internet cannot exfiltrate your credentials.
CI quota tracking (per-org minutes and concurrency)
Track exactly how many CI minutes your org consumes and enforce concurrency limits per plan.
Fork-PR approval gate for first-time contributors
First-time contributors from forks wait for a maintainer to approve CI. Protect your runner credits from abuse.
Event-driven mergeability recompute
Merge eligibility updates in real time as CI results arrive. You always see an accurate merge button state.
Commit status API for external integrations
Post CI status from any external tool via the commit status API. Third-party systems integrate without a plugin.
Automated CD (auto-deploy from main, gated on CI)
Every merge to main that passes CI deploys automatically. No manual release steps, no deployment scripts to maintain.
Off-node CD runner (privileged deploy lane)
Deploys run on a dedicated off-node runner that holds the deploy credentials. CI and CD never share a trust boundary.
CD run history (timestamps, SHAs, status)
Every deploy is logged with its exact commit SHA, timestamp, and outcome. Know exactly what is running in production.
Redeploy from UI without re-push
Kick off a redeploy from the deployments page without touching git. Useful for rollbacks and infra-only changes.
Declarative CD config in source
Define your deployment pipeline in a checked-in config file. Version your deploy behavior alongside your code.
Stripe billing (hosted checkout)
Stripe billing is built and ready: hosted checkout, webhook entitlement sync, and the self-service billing portal are all wired. Self-serve subscriptions open when the live flag is lifted.
Plan tiers and entitlements (Free, Premium, Ultimate)
Pick the plan that fits your team. Every tier is clearly defined with no hidden feature gates.
Open-core commercial model (Free / Premium / Ultimate, GitLab-style)
The four GitStache differentiators and the full forge are free forever in both SaaS and self-hosted. Premium and Ultimate unlock enterprise capabilities on top of that permanently-free core. No bait-and-switch.
Public pricing page
A transparent three-tier pricing matrix at /pricing shows exactly what is free and what costs money, with a direct upgrade path and a contact route for Ultimate.
Pledge-guard enforcement (structural paid-feature gates)
Paid features are enforced structurally, not by convention. You cannot accidentally use an unlicensed feature.
Org creation and settings
Create organizations, configure their settings, and invite your whole team from one page.
Org member invitations (email accept and decline)
Invite anyone to your org by email. They accept or decline with one click from the invite email.
Team member management
Add and remove team members, adjust roles, and audit membership from a single team settings page.
Owner namespace unification (no user and org name collisions)
User and org slugs share one namespace. Repo URLs never collide no matter who owns them.
WorkOS Organizations for enterprise multi-tenancy and SCIM
Enterprise customers get isolated WorkOS Organization tenancy with SCIM provisioning for hands-off user lifecycle management.
Gitaly-style git-rpc service
All git operations go through a typed RPC service with transactional ref management and a git-compatible wire format.
Streaming diff API (chunked)
Diffs stream chunk by chunk so the browser renders progressively. Large diffs never block the network.
pkt-line protocol via go-git
Native pkt-line support via go-git means any standard git client works without special configuration.
GitHub importer (repos, issues, PRs, releases)
Import everything from GitHub asynchronously with checkpoint recovery. Switch without losing your history.
Round-trip export (git bundle and JSON sidecars)
Export your repo as a standard git bundle with JSON sidecars for issues and PRs. Your data is always yours to take.
Export API (download bundle)
Trigger an export and download the bundle via API. Automate data custody without logging into the UI.
Gitea and Forgejo-compatible export
Export format is compatible with Gitea and Forgejo importers. Migrate to a self-hosted alternative at any time.
Docker Compose appliance (single-node, under 10-minute setup)
Run GitStache on your own hardware with a single docker compose up. Full feature parity with the hosted version.
Helm chart for Kubernetes
Deploy to any Kubernetes cluster with the official Helm chart. Production-grade topology out of the box.
NATS JetStream eventing backbone
Realtime event delivery runs on NATS JetStream. Durable streams, at-least-once delivery, and horizontal scale.
OpenTelemetry observability
Every service emits traces, metrics, and logs in OpenTelemetry format. Plug in any compatible backend.
Let's Encrypt cert provisioning
TLS certificates are provisioned and renewed automatically. No manual cert management ever.
Layered S3-backed object storage cache
Git objects are cached in a layered store backed by S3. Cold storage costs drop as hot objects stay local.
WAL archiving and point-in-time recovery
Continuous WAL archiving means you can restore your database to any point in time, not just the last backup.
EBS snapshot automation
Disk snapshots are automated. No manual backup scripts, no forgotten midnight jobs.
Self-hosted per-seat license key (PASETO-signed, offline-validatable)
A cryptographically signed, offline-validatable PASETO token unlocks Premium and Ultimate features on your self-hosted appliance. Air-gapped and sovereign deployments work without phoning home. Expiry degrades gracefully to read-only Free, never a hard lockout.
SSE for PR review updates
Review comments and approval state push to every open tab in real time. Collaborate without manual refreshing.
Live mergeability tracking
The merge button reflects real CI and approval state the moment it changes. No stale merge-blocked state.
Vue Query realtime client sync
Realtime events invalidate the right queries automatically. Data is always fresh without manual polling.
Authenticated event stream (SSE)
The event stream is authenticated and scoped to your access level. You only receive events for repos you can see.
Public landing page
A polished, unauthenticated landing page for new visitors. Discoverable, fast, and served to search engines.
Responsive, mobile-first design
The entire product works on any screen size. Mobile users get the same functionality without a degraded experience.
Dark mode (system preference with accessible contrast)
Dark mode follows your system preference automatically. All color pairs meet WCAG 2.2 AA contrast in both themes.
Command palette (Cmd/Ctrl-K)
Navigate anywhere and trigger any action from the keyboard. Power users never need to touch the mouse.
File creation in web UI
Create new files directly from the browser with a full-featured editor. No local clone required for quick edits.
File editing in web UI (with conflict detection)
Edit files in the browser with automatic conflict detection. You are warned before saving over concurrent edits.
Onboarding flows (account, import, first PR)
Guided onboarding from account creation to your first import and first PR. New users hit productivity faster.
STAMP design system (neobrutalist, accessible)
Consistent visual language across every surface: numbered badges, offset-shadow elevation, and tactile-lift cards.
WCAG 2.2 AA accessibility
Every surface meets WCAG 2.2 Level AA. Keyboard navigation, screen reader compatibility, and sufficient color contrast throughout.
Reduced-motion support
All non-essential animations are disabled when you prefer reduced motion. Semantic color changes remain.
Unauthenticated read of public repos, PRs, and issues
Public repositories, pull requests, and issues are fully readable without logging in. Search engines can index them and newcomers can evaluate the project before creating an account.
Public changelog and feature directory
Every GitStache feature in one place at /changelog: what is live today, what is actively building, and what is on the road ahead. Updated every time something ships.
Git CLI PAT authentication
Use a personal access token with any git client. Standard credential-helper integration, no special tooling.
SSH git authentication
Push and clone with your existing SSH key. No new keys to generate and no extra configuration steps.
Webhook support (repos and orgs)
Receive webhook events for any repo or org activity and build integrations without polling. On the roadmap.
API documentation (Swagger and OpenAPI)
A published OpenAPI/Swagger spec for every endpoint, so you can build clients without guessing the schema. On the roadmap.
gRPC API for client libraries
A typed gRPC API powers the official client libraries and is available for custom integrations.
Repository stars
Star repositories to bookmark them and signal appreciation to the maintainers.
SCIM 2.0 provisioning
Automate user and group provisioning from your identity provider with SCIM 2.0. Onboarding and offboarding without manual steps.
Immutable audit logging (hash-chain backed, S3 WORM)
Every privileged action is logged in a tamper-evident hash chain stored on S3 WORM. Compliance-grade audit trail.
Compliance log export (OCSF and CEF)
Export audit logs in OCSF or CEF format for your SIEM. Standard formats that integrate with any compliance toolchain.
6-year audit retention
Audit logs will be retained for six years by default to satisfy the most common compliance frameworks out of the box.
AI features (strictly opt-in by design)
The opt-in framework is built: AI capabilities are never enabled without explicit activation. Active AI features are in development and none are live yet.
Local LLM support (Ollama, zero-egress)
Run AI features entirely on your own hardware with Ollama. Zero data leaves your network. On the roadmap once opt-in AI features ship.
Flaky-test scoring
Track flakiness scores per test across runs. Stop chasing random CI failures and fix the tests that actually matter.
Ready to ship better code?
GitStache is open source and self-hostable. Start with Docker Compose in under ten minutes.