Outside (external) collaborators should never have admin permission across the organization. Admin grants the ability to add/remove collaborators, modify protected branches, and access secrets - powers that should be reserved for trusted org members. External collaborators with admin access are a frequent supply-chain attack vector and a top finding in GitHub security audits.
1. Go to Organization -> Outside collaborators. 2. For each collaborator, review their permissions. 3. Downgrade any 'Admin' permission to 'Maintain', 'Write', or lower as appropriate.
{
"target": "GHOutsideCollaborator",
"if": {
"allOf": [
{
"resource": "GHOutsideCollaborator",
"property": "Permissions.Admin",
"operator": "notEquals",
"value": true
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation | v1.0.2