Org-level Codespaces secrets with visibility 'all' are exposed in every codespace launched from any repository in the organization. Codespaces secrets are typically API keys or tokens used inside the dev environment; over-broad visibility means any developer launching any repo's codespace inherits credentials they may not need - a violation of least-privilege and a data-residency concern when codespaces span regions. Use 'selected' visibility.
1. Go to Organization Settings -> Secrets and variables -> Codespaces. 2. For each secret with visibility 'All repositories', change to 'Private repositories' or 'Selected repositories' as appropriate.
{
"target": "GHCodespacesSecret",
"if": {
"allOf": [
{
"resource": "GHCodespacesSecret",
"property": "Visibility",
"operator": "notEquals",
"value": "all"
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation | v1.0.2