How to Prove Your Code Existed Before a Patent Filing
The scenario is brutal: you built a novel feature, shipped it inside a private repo, and moved on. Eighteen months later, a competitor files a patent on the same technique. If you cannot prove your implementation existed before their filing date, the conversation shifts from “we built this first” to “prove it.” This guide shows you exactly how to prove your code existed before a patent filing using Timestamp GIT and its managed GitHub App. By the end, you will have immutable, Bitcoin-anchored timestamps for your Git commits, ready to support a prior-art defense.
The hard way would mean learning the OpenTimestamps protocol, running manual anchoring steps, and maintaining your own proof pipeline. Timestamp GIT removes that: install the GitHub App once, connect a repository, and every commit is batched and anchored into the Bitcoin blockchain automatically each night.
Prerequisites: What You Need Before You Start
You do not need a Bitcoin wallet, a blockchain node, or any cryptographic tooling. You need:
- A GitHub account and at least one repository containing the code you want to protect. Public repositories can use the free Open Source plan; private repositories require a paid plan.
- Basic familiarity with Git commits and GitHub repository settings. You should know how to push commits, install a GitHub App, and read workflow logs.
- A Timestamp GIT account. The free tier covers public repositories. For private repositories, the Pro Agency plan is $49/mo and Enterprise ZK Mode is $199/mo.
- Optional: for air-gapped or self-hosted environments, a Docker host. Timestamp GIT publishes a Docker image and provides a time-limited demo license.
If you want to evaluate the self-hosted path, the quick-start Compose file looks like this:
services:
timestampgit:
image: rue1401/timestampgit:prod
ports:
- "8080:8080"
volumes:
- ./data:/app/data
restart: unless-stopped
valkey:
image: valkey/valkey:8
restart: unless-stopped
docker compose pull
docker compose up -d
docker compose logs -f timestampgit
For most developers, however, the managed GitHub App is the fastest route. This guide follows that managed path.
Step-by-Step: Anchoring Your Code to Bitcoin with Timestamp GIT
Step 1: Install the Timestamp GIT GitHub App
Start from the Timestamp GIT dashboard and install the GitHub App. Select the target repository you want to monitor. In Standard Mode, the GitHub permission system requires read access to the source repository because GitHub cannot expose only a commit hash. Timestamp GIT reads only the HEAD commit hash, not the contents of your files.
The app also needs write access to a target repository where proofs will be stored. That target can be the same repository on a dedicated branch, or a separate shadow repository.
Step 2: Configure Which Repositories to Monitor
After installation, open the repository list in the dashboard and enable monitoring for the repositories you want to protect. Once enabled, the GitHub App detects new commits via webhooks. There is no CLI to install, no pre-commit hook to configure, and no OpenTimestamps command to learn.
Each detected commit hash enters an in-memory queue for daily processing. Timestamp GIT does not store, copy, or read your source code.
Step 3: Keep Standard Mode or Switch to Enterprise ZK Mode
Standard Mode is enough for many teams. The GitHub App reads the HEAD commit hash automatically and writes the proof files back to your chosen target branch.
For maximum zero-knowledge operation, choose Enterprise ZK Mode. A short GitHub Action runs on your infrastructure and pushes only the commit hash and commit ID to the Timestamp GIT API. In this mode, Timestamp GIT does not need read access to the source repository at all. Your source never leaves your environment.
Your dashboard provides the exact action snippet. Conceptually, the workflow only sends metadata — never files, paths, blobs, or repository contents.
Step 4: Let the Nightly Cron Worker Anchor Your Hashes
Timestamp GIT processes pending hashes once per day. At midnight, a cron worker:
- Groups pending commit hashes by repository.
- Creates manifest files for each repository.
- Builds a Merkle tree natively.
- Creates OpenTimestamps proofs using public OTS calendars.
- Anchors the Merkle root into the Bitcoin blockchain.
After the daily anchor, the proof creation continues in the background. Bitcoin confirmation normally takes around three hours, so proofs appear a few hours after the nightly batch starts. You do not need to monitor this process or trigger it manually.
Step 5: Receive the Immutable Proof Files
Once confirmation completes, Timestamp GIT pushes the proof artifacts back to your repository. You will see:
- A manifest file describing the batch and the commits covered.
- One or more
.otsreceipt files containing the cryptographic timestamp proof.
The files live on a dedicated timestamps branch or in a shadow repository, depending on your configuration. They are ordinary files in Git, so they are easy to preserve, copy, and hand to an attorney.
Step 6: Add a Verification Badge to Your README
From the Repository Connected page, copy the generated badge embed code. It follows the standard Shields.io-style markdown pattern:
[](https://timestampgit.dev/status/{user}/{repo})
Replace {user} and {repo} with your actual GitHub account and repository name. The badge links to the public status dashboard, where anyone can inspect the earliest anchor date, daily regularity, and Bitcoin block data.
For private repositories, the badge URL includes an encrypted HMAC so only authorized users can view the status.
Step 7: Download the PDF Certificate or Audit CSV
For legal records, open the Repository Status dashboard and download:
- A PDF certificate for a specific date.
- A full audit CSV listing the complete ledger of timestamped commits.
Both are useful when you need a human-readable record for counsel, an investor, or a court filing. The underlying .ots file remains the mathematically independent proof.
How to Verify Your Timestamp Actually Worked
Check the Repository Status Dashboard
The public status page is the fastest signal. It displays:
- Proof longevity and earliest anchor date.
- Daily anchoring regularity.
- Bitcoin block height and transaction data.
- A calendar heatmap of timestamped days.
If you see the current commit date with a confirmed Bitcoin block, the anchor succeeded.
Run Local Verification in Your Browser
The verification page at /verification/{user}/{repo}/{date} performs a step-by-step Merkle chain verification locally in your browser. This means the verification computation does not rely on Timestamp GIT’s server to prove its own result. You follow the cryptographic path from your commit hash up to the Bitcoin block.
Independently Verify the .ots Receipt
Because the proof uses only SHA-256 and Bitcoin block data, you are not locked into Timestamp GIT. You can download the .ots receipt and verify it with standard OpenTimestamps verification tools against the Bitcoin blockchain. No proprietary software is required, so the proof remains valid even if the company disappears.
Confirm the README Badge
Finally, confirm that the badge in your README displays a verified state and links back to the public status page. That badge is a lightweight, external signal for colleagues, auditors, and maintainers.
Troubleshooting Common Issues
No commits are being timestamped
Check GitHub App permissions first. In Standard Mode, Timestamp GIT must have read access to the source repository and write access to the target repository or branch. If either permission is missing, commit hashes cannot be read and proofs cannot be written.
Proofs take too long
A timestamp is not instant. Timestamp GIT batches hashes nightly, then anchors the Merkle root into Bitcoin. Bitcoin confirmation normally takes around three hours after the transaction is broadcast. Proofs are written after confirmation, so a delay of several hours is expected.
Private repository status is not visible
Private repository status URLs use an encrypted HMAC tied to the Timestamp GIT server instance. If the status page is blank or unauthorized, make sure you are authenticated on the same instance and using the link generated for your private repo.
Self-hosted setup fails
For Docker self-hosting, verify that the Compose file is valid, the license file is mounted correctly, and the valkey service is running. The Timestamp GIT logs from docker compose logs -f timestampgit are the first place to check.
FAQ
Is a Bitcoin timestamp legally recognized as prior art?
While laws vary by jurisdiction, cryptographic timestamps provide strong evidence of existence at a specific point in time. Timestamp GIT uses the OpenTimestamps protocol, which anchors data into the Bitcoin blockchain, making it extremely difficult to dispute. Always consult legal counsel for your specific case.
Do I need to expose my source code to Timestamp GIT?
No. Timestamp GIT only processes Git commit hashes, never your source code. In Standard Mode, the GitHub App reads only the HEAD commit hash. In Enterprise ZK Mode, a GitHub Action on your infrastructure pushes only the hash to the API, so your code never leaves your environment.
What if Timestamp GIT goes out of business? Will my proofs still be valid?
Yes. Your proofs are anchored in the Bitcoin blockchain and can be verified independently using standard OpenTimestamps tools. The proof relies only on SHA-256 and Bitcoin block data, with no proprietary technology or lock-in.
Can I use Timestamp GIT for private repositories?
Yes, with the Pro Agency plan at $49/mo or the Enterprise ZK plan at $199/mo. Private repository status URLs are protected with an encrypted HMAC, so only authorized users can view the timestamp status.
Conclusion: Secure Your Prior Art Today
You now have a repeatable workflow for proving code existed before a patent filing. Connect the GitHub App, let nightly anchoring run, and collect the .ots receipts, PDF certificates, and audit logs. The result is a cryptographic prior-art shield that does not depend on your own logs, a third-party server, or the continued existence of Timestamp GIT.
Install the Timestamp GIT GitHub App now and connect your first repository. Public repositories can start free; private repositories are covered by Pro Agency or Enterprise ZK plans. For air-gapped environments, request a Docker demo license and self-host the same pipeline. The next patent claim should meet your proof before it escalates.
For a broader look at why this matters in litigation and licensing pressure, see Timestamp Git Commits to Defend Against Patent Trolls.
Related posts
- Timestamp Git Commits to Defend Against Patent Trolls
- Automate Code Timestamping with a GitHub App
- The Best GitHub App for Timestamping Your Commits
