DOS4230

Organization Credential Authorizations - Should have a descriptive title

DOS4230

GitHub organization Severitymedium builtIn

Description

Every PAT or SSH key authorized for SAML SSO should carry a meaningful title or note describing its intended use (e.g., 'CI build agent prod-east-1', 'developer-laptop-2'). Untitled credentials are difficult to revoke confidently during incident response because their owner and purpose are unknown.

Learn More

Recommendation

1. Go to your User Settings -> Developer settings -> Personal access tokens. 
2. For each token, edit the 'Note' to describe its purpose. 
3. Re-authorize the token for the SSO-protected organization.

Policy Rule

{
  "target": "GHCredentialAuthorization",
  "if": {
    "allOf": [
      {
        "resource": "GHCredentialAuthorization",
        "property": "AuthorizedCredentialTitle",
        "operator": "notEquals",
        "value": ""
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS4225 DOS4240 »
Rule Details
  • Rule ID: DOS4230
  • Code: GH_Organization_CredentialAuth_Should_Have_Title
  • Platform: GitHub
  • Category: organization
  • Severity: Severitymedium
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions | v1.0.2