Stop the merge.
Not the team.
Org-wide merge and deploy freezes for GitHub. Schedule them, trigger them from Slack, and let the hotfix through — with a record of who did what.
Free forever for 5 private repos · Unlimited users on every plan · Never reads your code.
This is the whole product
main
- ci / testSuccessful in 3m 41s
fwozen — Thawed. Nothing is blocking this merge.
A real component in the real design system, with fictional data. Nothing is sent anywhere.
- Never reads your code →
- Installs in 90 seconds
- shipped yesterday
- System status →
You already have a freeze process. It’s just not a control.
“We put FREEZE — DO NOT MERGE in the channel topic.”
“We hand-edit branch protection on 30 repos.”
“We wrote a cron job. It broke in December.”
All three work right up to the moment somebody merges anyway. None of them can tell you whether the freeze was in force, who lifted it, or why.
Three steps, then it’s someone else’s problem.
- Step 1
Install the GitHub App
Pick every repo or a subset. Seven read-and-check permissions, none of them contents: write.
- Step 2
Pick repos and branches, or the whole org
A glob like services/** counts its matches before you commit to it. Fwozen verifies the freeze would actually block a merge, and says so in red when it would not.
- Step 3
Freeze from the web, Slack, or the API
On a schedule, during an incident, or from a CI job. Every freeze carries a reason, and the reason shows up on the pull request.
curl -H "Authorization: Bearer $FWOZEN_TOKEN" \
-d '{"scope":{"kind":"org"},"reason":"4.2 cut"}' \
https://api.fwozen.com/v1/freezesThe REST API is in the free tier, with scoped tokens and an OpenAPI document. So is the Slack app, and so is scheduling. Those are the three things the incumbent charges for.
A freeze you can prove held.
Holding
Frozen means frozen. fwozen is required on main and only Fwozen can satisfy it.
Advisory
fwozen is required, but 3 actors can bypass it: @alice, Repository admins, org-owners.
Not enforced
Freezes on this branch will be advisory only — the merge button will still work.
Fwozen reads GitHub’s effective rules for each branch — every contributing ruleset, whether the fwozen check is required, whether it is pinned to us, and every actor who can bypass it, listed by name rather than counted.
A reconciler re-checks and re-asserts state continuously, so the badge above is a measurement rather than a promise. This exists because of one specific failure: a “freeze” that was never actually required on the branch is just a red X somebody with merge rights can click past. If that is your situation, we would rather show you red than let you find out during the incident.
Frozen mid-queue still means frozen.
A pull request that entered the merge queue before your freeze started will merge after it, unless someone fails the live merge-group head. Fwozen fails it — the instant the freeze begins, every in-flight merge group is re-evaluated and blocked.
Checked 29 July 2026docs.mergefreeze.com/github-merge-queue
The freeze doesn’t stop at the merge button.
A merge freeze that lets a deploy through is half a control. Fwozen ships a fwozen/deploy-gate check, a GET /v1/freeze-state endpoint for pipelines that aren’t GitHub Actions, and an Action for the ones that are.
- name: Check the freeze
uses: fwozen/gate-action@v1
with:
token: ${{ secrets.FWOZEN_TOKEN }}
environment: production
# Fails while a freeze is in force.Deploy gating starts at Team ($29/mo). It works on every GitHub plan because it is a required check plus an Action — GitHub’s native custom deployment protection rules need Enterprise for private repositories, and that integration is next, not now.
Let the hotfix through. Keep the record.
- ci / testSuccessful in 3m 41s
- Request exception
fwozen — Frozen by @dana · “4.2 release cut” · thaws in 1h 58m
Merges to
mainare frozen. Ask a release manager for an exception, or wait for the freeze to lift.
Reason, required
Typed by the person granting it, shown verbatim on the pull request, in Slack, and in the audit log. “Because Dana said so in a DM” stops being the record.
A time limit, not a hole
One hour, four hours, or until the freeze ends. Exceptions expire on their own, which is the difference between an exception and a permanently unfrozen branch.
Sticky or strict, your policy
Sticky keeps the exception when new commits land; strict revokes it. Pick per org, and the pull request says which one is in force.
Per-PR exceptions start at Team. If your override process today is a Slack argument, this is the part that pays for itself.
You could do this with GitHub rulesets. Here’s when that stops working.
| GitHub rulesets (free) | Fwozen | |
|---|---|---|
| Block merges to a branch | Yes — Restrict updates or a required check | Included |
| Cost | Free | Free to $99 |
| Turn it on for 40 repos at 5pm Friday | Manual, or a script you maintain | One switch |
| Scheduled or recurring windows | Not included | Yes — timezone- and DST-correct |
| A non-admin can freeze during an incident | Needs admin | Included |
| Time-boxed exception for one pull request | Not included | Yes — reason + TTL |
| Who froze it, when, and why | Not included | Yes — audit log |
| Also blocks deploys | Not included | Included |
If you have three repos and one admin, use rulesets. We mean that. Fwozen starts paying for itself around repo ten, or the first time an incident happened at 2am and the only person who could freeze main was asleep.
The full rulesets comparison, including how to freeze a branch with rulesets for free →
Fwozen never reads your code.
Seven permissions. Here is each one, what it lets us do, and what it does not.
| Permission | Level | Why we need it | What this does not allow |
|---|---|---|---|
| checks | write | Create and update the fwozen check run that blocks the merge. | Reading file contents, or writing anything except our own check runs. |
| statuses | write | The legacy fwozen/status mode, for orgs still on classic branch protection. | Reading code, or modifying another app’s statuses. |
| pull_requests | read | List open pull requests so we know which head SHAs to write to. | Reading diffs. We do not request patch contents. |
| contents | read | GitHub requires it to deliver push events and to read the default branch ref. | We never call the contents API for file data. This permission is the single most common misreading of a GitHub App’s scope — see the note below. |
| metadata | read | Repository names and visibility. Mandatory for every GitHub App. | — |
| merge_queues | read | Receive merge_group events so a queued pull request cannot slip through a freeze. | Modifying the queue. |
| Organization members | read | Verify that the person clicking Freeze is actually in your org. | Reading emails or profile data beyond membership. |
What we never ask for
contents: write— Never, under any circumstance. Fwozen does not write to your repositories.administration: write— Not in the core set. One-click ruleset setup uses your own admin authorization, which is kept encrypted so the rule can be repaired, and which you can revoke in GitHub at any time.Slack user-token scopes— None. The Slack app is bot-only.Slack message history— None. Fwozen reads its own slash commands and nothing else.issues, workflows, deployments, secrets, packages, actions— None of them.
We ask for less access than MergeFreeze does — here’s the comparison. Their branch-protection freeze method requires Administration: read & write on your repositories. Ours is not in the core set at all.
Priced so you don’t have to ask anyone.
Unlimited users and unlimited private repos on every paid plan.
Team
When repo five stops being enough.
$290/year
$24/mo billed annually
Trial: 14 days of Business, no card
Business
Most popularMore than one GitHub org, and an auditor.
$990/year
$83/mo billed annually
Trial: 14 days, no card
Enterprise
SSO, invoicing, and a signed SLA.
from$2,990/year
$249/mo billed annually
Questions people actually ask.
What if Fwozen is down — does that block our merges?
Yes, and that’s the design. The fwozen check is required, so if we can’t report a result the check stays pending and the merge waits. A freeze app that failed open would be worthless.
What we owe you instead is not going down: a reconciler that re-asserts state every few minutes, a public status page, and freeze propagation that is typically under a minute — we publish the measured number rather than a target we haven’t load-tested.
If you’d rather fail open during an outage, remove the required check. One setting, your call.
Does it work with merge queues?
Yes, and this is the case most tools get wrong. A pull request that entered the queue before the freeze started will otherwise merge after it. When a freeze begins, Fwozen re-evaluates and fails every live merge-group head SHA, so the queue drains into a blocked state instead of merging behind you.
What happens to open pull requests when we freeze?
Fwozen writes the fwozen check to the head commit of every open pull request in scope — typically under a minute for a few hundred repositories, and you can watch the fan-out finish. If a branch has no open pull requests there is nothing to write to, and the next one opened is blocked immediately.
Can non-admins freeze?
Yes. Freezing is a Fwozen permission, not a GitHub admin permission, so a release manager or an on-call engineer can freeze without being able to change branch protection. That is the main reason teams outgrow rulesets: changing a ruleset at 2am requires an admin, and the admin is asleep.
Do you read our code?
No. We never request contents: write, and we call zero content endpoints. GitHub bundles push event delivery behind contents: read, which is the only reason that scope appears in the list — every permission is itemised here, including the exact API calls we make.
How is this different from MergeFreeze?
Five things, in the order they matter: enforcement we verify against GitHub’s effective rules instead of asking you to configure it by hand, check runs instead of legacy commit statuses, merge-group safety, scheduling and the API in the free tier, and an audit log with a real actor in every row. The comparison is dated and sourced, including what they do better.
Can we cancel ourselves?
Yes, in the app, in two clicks. No email required.
What happens when the trial ends?
You drop to Free. Freezing keeps working. We will never break a freeze over billing — for a safety product, a billing-induced failure to freeze is an incident we caused for you.
Freeze something this afternoon.
Install the app, watch a two-minute freeze land on a real branch, and thaw it. If it isn’t obviously useful in ten minutes, we would rather you didn’t pay us.