Check ID: organization_default_repository_permission_strict
Provider: GitHub
Service: organization
Severity: HIGH
Categories: identity-access
Resource type: NotDefined

​
What this check verifies

GitHub organization base repository permission for members uses a strict setting such as read or none rather than permissive options like write or admin. Applies to members, not outside collaborators.

​
Risk

Excessive default permissions (write/admin) erode code integrity and availability. Any member-or a compromised account-can alter many repos, inject malicious commits, change tags/releases, or delete branches, enabling supply-chain compromise and large-scale disruptions.

​
Recommendation

Apply least privilege: set base permission to none or read. Grant higher access explicitly via teams per repo and enforce separation of duties with required reviews and branch protection. Regularly audit memberships and access to limit blast radius and maintain defense in depth.

​
Remediation

resource "github_organization_settings" "<example_resource_name>" {
  default_repository_permission = "read" # Critical: sets the org's base repository permission to a strict level (read/none passes)
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = organization_default_repository_permission_strict. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks