DOS4250

Organization Member - Type should be 'User' (not 'Bot')

DOS4250

GitHub organization Severitymedium builtIn

Description

Organization members should be of type 'User'. Bot accounts that appear as full members (rather than as integrations or apps) typically indicate misconfigured automations - bots should be installed as GitHub Apps with scoped permissions, NOT added as full org members with the broad permission surface that membership grants.

Learn More

Recommendation

1. Go to Organization -> People. 
2. Identify any 'Bot' type members. 
3. Convert each bot to a GitHub App with the minimum required scopes, then remove the bot from membership.

Policy Rule

{
  "target": "GHOrganizationMember",
  "if": {
    "allOf": [
      {
        "resource": "GHOrganizationMember",
        "property": "Type",
        "operator": "equals",
        "value": "User"
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS4245 DOS4260 »
Rule Details
  • Rule ID: DOS4250
  • Code: GH_Organization_Member_Type_Should_Be_User
  • Platform: GitHub
  • Category: organization
  • Severity: Severitymedium
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions | v1.0.2