Skip to content

GitHub configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On GitHub, Black Cat runs 13 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the GitHub connector needs.

Checks (13)

severity: high Repo Secret Scanning Disabled fix difficulty: easy #

Enable secret scanning and push protection on GitHub repositories to detect leaked credentials

  1. Navigate to the repository Settings > Advanced Security
  2. Enable 'Secret scanning'
  3. Optionally enable 'Push protection' to block commits containing secrets

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Repo Dependabot Disabled fix difficulty: easy #

Enable Dependabot alerts and security updates on GitHub repositories

  1. Navigate to the repository Settings > Advanced Security
  2. Enable 'Dependabot alerts'
  3. Enable 'Dependabot security updates' for automatic PRs

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Public Repo Without Security Policy fix difficulty: easy #

Add a SECURITY.md file to public GitHub repositories documenting vulnerability reporting

  1. Create a SECURITY.md file in the repository root or .github/ directory
  2. Document how to report security vulnerabilities
  3. Include a contact email or link to a security reporting form

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Actions Allow All External fix difficulty: easy #

Restrict GitHub Actions permissions to allow only GitHub-created or trusted actions

  1. Navigate to GitHub Organization Settings > Actions > General
  2. Change 'Actions permissions' to 'Allow select actions'
  3. Choose 'Allow actions created by GitHub' or specify trusted action creators

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Webhook Insecure URL fix difficulty: easy #

Update GitHub webhooks to use HTTPS URLs and add a secret for payload verification

  1. Navigate to GitHub Organization Settings > Webhooks
  2. Update the webhook URL to use HTTPS
  3. Add a webhook secret for payload verification
  4. Test the webhook to ensure it still receives events

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Org Dependabot Alerts Disabled fix difficulty: easy #

Enable Dependabot alerts at the organization level so new repositories inherit vulnerability detection

  1. Navigate to GitHub Organization Settings > Code security and analysis
  2. Enable "Dependabot alerts" for all new repositories
  3. Optionally enable for existing repositories using the bulk enablement option
  4. Verify alerts are active on a sample repository

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Org Secret Scanning Disabled fix difficulty: easy #

Enable secret scanning at the organization level to detect leaked credentials in new repositories

  1. Navigate to GitHub Organization Settings > Code security and analysis
  2. Enable "Secret scanning" for all new repositories
  3. Optionally enable "Push protection" to block commits containing secrets
  4. Verify secret scanning is active on a sample repository

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Actions Runner Allows Public Repos fix difficulty: easy #

Disable public repository access on organization runner groups to prevent untrusted code execution

  1. Navigate to GitHub Organization Settings > Actions > Runner groups
  2. Select the runner group that allows public repositories
  3. Uncheck "Allow public repositories" to restrict runners to private repositories only
  4. Save changes and verify public repos can no longer use the runner group

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium GitHub Actions Enabled For All Repositories fix difficulty: easy #

Restrict GitHub Actions to selected repositories instead of all repositories

  1. Navigate to Organization Settings > Actions > General
  2. Under 'Policies', change 'Allow GitHub Actions' to 'Allow enterprise, and select non-enterprise, actions and reusable workflows'
  3. Select only the repositories that require Actions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Org Web Commit Signoff Not Required fix difficulty: easy #

Require web-based commit signoff for the organization

  1. Navigate to GitHub Organization Settings > Member privileges
  2. Enable 'Require contributors to sign off on web-based commits'
  3. Save the changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 CIS Controls v8 CIS-16.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Repo Secret Scanning Push Protection Disabled fix difficulty: easy #

Enable secret scanning push protection on the repository

  1. Navigate to the repository Settings > Advanced Security
  2. Enable 'Push protection' under Secret scanning

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Actions SHA Pinning Not Required fix difficulty: easy #

Require GitHub Actions to be pinned to a full-length commit SHA to close the mutable-tag supply-chain hole (the tj-actions/changed-files attack class)

  1. Navigate to Organization Settings > Actions > General
  2. Under 'Policies', enable 'Require actions to be pinned to a full-length commit SHA'
  3. Save the changes
  4. Audit existing workflows for tag/branch-referenced actions and re-pin them to a commit SHA

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Actions Selected-Actions Allowlist Pattern Unpinned fix difficulty: medium #

Replace wildcard, tag, or branch-referenced entries in the selected-actions allowlist with commit-SHA-pinned entries (allowlist patterns apply to public repositories)

  1. Navigate to Organization Settings > Actions > General
  2. Under 'Allow select actions and reusable workflows', review the 'Actions' patterns list
  3. Replace each wildcard/tag/branch entry (e.g. owner/repo@v4) with a full 40-character commit SHA (e.g. owner/repo@<sha>)
  4. Save the changes

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More GitHub checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial