Org-level Dependabot secrets with visibility 'all' are exposed to every repository in the organization, including newly-created ones. This violates least-privilege: Dependabot secrets are typically registry credentials (npm, PyPI, container registries) and should be scoped to the repos that genuinely need them via 'selected' visibility. The 'private' visibility (private repos only) is acceptable when ALL private repos legitimately consume the secret.
1. Go to Organization Settings -> Secrets and variables -> Dependabot. 2. For each secret with visibility 'All repositories', change to 'Private repositories' or 'Selected repositories' and pick only the repos that need access.
{
"target": "GHDependabotSecret",
"if": {
"allOf": [
{
"resource": "GHDependabotSecret",
"property": "Visibility",
"operator": "notEquals",
"value": "all"
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation | v1.0.2