# Enforcing device trust on code changes

DevFeed: [Enforcing device trust on code changes](<https://devfeed.tech/articles/enforcing-device-trust-on-code-changes-9810.md>)

Original publisher: [Read original article](<https://www.figma.com/blog/how-we-enforce-device-trust-on-code-changes/>)

Author: Griffin Choe

Published: 2023-12-08T00:00:00Z

Content type: article

Language: en

Sources: [Figma Blog](<https://devfeed.tech/sources/figma-blog.md>)

Topics: [Device Trust](<https://devfeed.tech/topics/device-trust.md>), [Figma](<https://devfeed.tech/topics/figma.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>), [pull-requests](<https://devfeed.tech/topics/pull-requests.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [WebAuthn](<https://devfeed.tech/topics/webauthn.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>)

Tags: [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [device-trust](<https://devfeed.tech/tags/device-trust.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [figma](<https://devfeed.tech/tags/figma.md>), [git](<https://devfeed.tech/tags/git.md>), [github](<https://devfeed.tech/tags/github.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [okta](<https://devfeed.tech/tags/okta.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [security](<https://devfeed.tech/tags/security.md>), [security-engineering](<https://devfeed.tech/tags/security-engineering.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [sso](<https://devfeed.tech/tags/sso.md>), [verification](<https://devfeed.tech/tags/verification.md>)

## AI overview

Figma's security engineering team describes enforcing device trust for code changes merged into GitHub release branches. The approach combines commit signature verification with Okta Device Trust certificates to ensure changes originate from trusted, company-managed devices, while addressing risks from leaked credentials, tokens, and SSH keys.

## Source excerpt

Here's how the Figma security engineering team leveraged commit signatures and Okta Device Trust certificates to protect GitHub release branches.