Repository deletion and transfer is owners-only

​

What this check verifies

Ensure repository deletion/transfer is restricted so only trusted organization users (owners) can delete or transfer repositories.

​

Risk

If members can delete or transfer repositories, accidental or malicious deletions can cause irreversible data loss, service disruption, and increased blast radius from compromised accounts.

​

Recommendation

Disable member repository deletion/transfer privileges so only organization owners can delete or transfer repositories.

​

Remediation

Dashboard steps

1. Sign in to GitHub as an organization owner
2. Go to Organization > Settings
3. Under “Access”, click “Member privileges”
4. Disable “Allow members to delete or transfer repositories”
5. Save changes

​

References

• https://docs.github.com/en/organizations/managing-organization-settings/setting-permissions-for-deleting-or-transferring-repositories

​

Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = organization_repository_deletion_limited. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to GitHub checks