Skip to content

GitHub access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On GitHub, Black Cat runs 21 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the GitHub connector needs.

Checks (21)

severity: high Org Default Permission Too Permissive fix difficulty: easy #

Set GitHub organization base permissions to Read or No permission to reduce default access

  1. Navigate to GitHub Organization Settings > Member privileges
  2. Change 'Base permissions' to 'Read' or 'No permission'
  3. Review existing repository access to ensure teams have appropriate permissions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Repo Branch Protection Disabled fix difficulty: easy #

Enable branch protection on the default GitHub branch to require pull request reviews

  1. Navigate to the repository Settings > Branches
  2. Click 'Add branch protection rule' for the default branch
  3. Enable 'Require a pull request before merging' with at least 1 approver
  4. Enable 'Require status checks to pass before merging'
  5. Consider enabling 'Include administrators' to enforce for all users

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Stale Organization Member fix difficulty: easy #

Remove stale GitHub organization members who no longer require access

  1. Review the member's recent activity in the organization
  2. Check if the member still requires access to the organization
  3. Remove the member if access is no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Repo Admins Bypass Branch Protection fix difficulty: easy #

Enable "Include administrators" on branch protection rules to prevent admins from bypassing reviews

  1. Navigate to the repository Settings > Branches
  2. Edit the branch protection rule for the default branch
  3. Enable "Do not allow bypassing the above settings"
  4. Save changes and verify admins can no longer push directly

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Repo Stale Reviews Not Dismissed fix difficulty: easy #

Enable dismissal of stale pull request reviews when new commits are pushed

  1. Navigate to the repository Settings > Branches
  2. Edit the branch protection rule for the default branch
  3. Under "Require a pull request before merging", enable "Dismiss stale pull request approvals when new commits are pushed"
  4. Save changes

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Team Admin Permission fix difficulty: easy #

Reduce team repository permission from admin to write or maintain to follow least privilege

  1. Navigate to GitHub Organization Settings > Teams
  2. Select the team with admin-level repository access
  3. Review each repository assignment and change permission from "Admin" to "Write" or "Maintain"
  4. Verify team members can still perform their required tasks with reduced permissions

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium OAuth App Broad Repository Access fix difficulty: easy #

Restrict GitHub App installation to selected repositories instead of all repositories

  1. Navigate to GitHub Organization Settings > GitHub Apps (Installed)
  2. Click "Configure" next to the flagged application
  3. Under "Repository access", change from "All repositories" to "Only select repositories"
  4. Select only the repositories the app needs access to
  5. Save the updated configuration

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high GitHub Actions Can Approve Pull Requests fix difficulty: easy #

Prevent GitHub Actions from approving pull requests so workflows cannot bypass review

  1. Navigate to Organization Settings > Actions > General
  2. Under 'Workflow permissions', disable 'Allow GitHub Actions to create and approve pull requests'

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high GitHub Actions Default Workflow Permissions Read-Write fix difficulty: easy #

Set the default GITHUB_TOKEN workflow permissions to read-only

  1. Navigate to Organization Settings > Actions > General
  2. Under 'Workflow permissions', select 'Read repository contents and packages permissions'
  3. Save the changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.2 SOC 2 Type II CC8.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Org Members Can Fork Private Repos fix difficulty: easy #

Disable forking of private repositories by organization members

  1. Navigate to GitHub Organization Settings > Member privileges
  2. Under 'Repository forking', disable 'Allow forking of private repositories'
  3. Save the changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Org Members Can Create Public Repos fix difficulty: easy #

Restrict members from creating public repositories in the organization

  1. Navigate to GitHub Organization Settings > Member privileges
  2. Under 'Repository creation', disable 'Public' repository creation
  3. Save the changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Org Repository Creation Unrestricted fix difficulty: easy #

Restrict which members can create repositories in the organization

  1. Navigate to GitHub Organization Settings > Member privileges
  2. Under 'Repository creation', restrict creation to specific roles or disable member creation
  3. Save the changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Repo Branch Deletion Allowed fix difficulty: easy #

Disable branch deletion on the protected default branch

  1. Navigate to the repository Settings > Branches
  2. Edit the branch protection rule for the default branch
  3. Disable 'Allow deletions'

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Repo Force Pushes Allowed fix difficulty: easy #

Disable force pushes on the protected default branch

  1. Navigate to the repository Settings > Branches
  2. Edit the branch protection rule for the default branch
  3. Disable 'Allow force pushes'

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Repo Insufficient Required Reviews fix difficulty: easy #

Require at least two pull request approvals on the protected default branch

  1. Navigate to the repository Settings > Branches
  2. Edit the branch protection rule for the default branch
  3. Under 'Require a pull request before merging', set 'Required number of approvals before merging' to 2 or more

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Too Few Organization Owners fix difficulty: easy #

Maintain at least two organization owners to avoid a single point of administrative failure

  1. Navigate to GitHub Organization Settings > People
  2. Identify a trusted member to promote to the Owner role
  3. Change their role from Member to Owner
  4. Verify at least two active owners can administer the organization

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Too Many Organization Owners fix difficulty: easy #

Reduce the number of organization owners to limit administrative blast radius

  1. Navigate to GitHub Organization Settings > People
  2. Review each member holding the Owner role
  3. Downgrade owners who do not require full administrative access to Member
  4. Keep a small set of owners (recommended max 5) for resilient but contained administration

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Fine-Grained PAT Stale fix difficulty: easy #

Review or revoke organization fine-grained PATs unused for over 90 days

  1. Navigate to GitHub org Settings > Personal access tokens > Active tokens
  2. Identify the token by name and owner
  3. Contact the owner to confirm it is still required
  4. Revoke the token if it is no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Fine-Grained PAT Broad Access fix difficulty: medium #

Restrict fine-grained PATs that hold write/admin access to all repositories

  1. Navigate to GitHub org Settings > Personal access tokens > Active tokens
  2. Identify the token granting write/admin access to all repositories
  3. Contact the owner to scope the token to specific repositories
  4. Revoke and reissue the token with least-privilege repository selection

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Copilot Allows Public Code Suggestions fix difficulty: easy #

Block Copilot suggestions matching public code to avoid surfacing snippets without clear license or provenance

  1. Navigate to Organization Settings > Copilot > Policies
  2. Set 'Suggestions matching public code' to 'Blocked'
  3. Save the changes

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Copilot Seat Inactive fix difficulty: easy #

Review and remove Copilot seats with no observed activity in over 90 days; last_activity_at only reflects IDE use when the user has telemetry enabled, so this is a telemetry-dependent signal requiring owner confirmation before removal

  1. Navigate to Organization Settings > Copilot > Access
  2. Identify the seat assignee flagged with no observed activity
  3. Confirm with the assignee or their manager that Copilot access is no longer needed (telemetry may under-report actual use)
  4. Remove the seat assignment if confirmed unused

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More GitHub checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial