DOS5850

Repository Collaborator - Outside collaborators should not have admin permission

DOS5850

GitHub repository Severitycritical builtIn

Description

When the per-repo collaborator audit (G2.4) lists a collaborator with Affiliation = 'outside' AND Permissions.Admin = true, this is a critical finding: an external user has admin rights on a specific repository. This is the per-repo equivalent of the org-level outside-collaborator audit and surfaces overrides where an outside collaborator was granted admin on a single repo despite org-level policy.

En savoir plus

Recommandation

1. Go to Repository Settings -> Collaborators and teams. 
2. Identify outside collaborators with admin role. 
3. Downgrade their permission to Maintain, Write, Triage, or Read as appropriate.

Règle de politique

{
  "target": "GHRepositoryCollaborator",
  "if": {
    "allOf": [
      {
        "resource": "GHRepositoryCollaborator",
        "property": "Affiliation",
        "operator": "equals",
        "value": "outside"
      },
      {
        "resource": "GHRepositoryCollaborator",
        "property": "Permissions.Admin",
        "operator": "notEquals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS5815 DOS5855 »
Détails de la règle
  • ID de la règle: DOS5850
  • Code: GH_Repository_Collaborator_Outside_Should_Not_Have_Admin
  • Plateforme: GitHub
  • Catégorie: repository
  • Sévérité: Severitycritical
  • Type: builtIn
Règles connexes

Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation | v1.0.2