COMMIT SIGNING SERVICE

Verifying signed source code using a vault device is described. An example method can include receiving, at a vault device, an object verification request, the object verification request comprising developer credentials associated with the object verification request, an object, and a first commit signature associated with the object. The method can further include determining a identity associated with the developer credentials, obtaining a signing key associated with the identity, and generating a local commit signature using the signing key. In addition, the method can include comparing the local commit signature with the first commit signature, and upon determining that the first commit signature and the local commit signature match, returning an indication of a successful verification.