Platform/GitHub Repository Security
Code & Supply Chain

GitHub Repository Security Reviews

Audit your GitHub organisation for leaked credentials, insecure CI/CD workflow permissions, missing branch protection rules, and overprivileged third-party OAuth apps.

Business Outcome:Prevent source code theft and CI/CD pipeline compromise across your internal and contractor engineering teams.
Check My Business Security Book a 1-to-1 UK Demo
Setup time
< 60 seconds
CI/CD checks
Actions & Secrets
Access governance
Org & Collaborators
Example DetectionHigh
GitHub Actions Workflow Grants Default Read/Write Token to Pull Requests

Compromised dependencies or malicious PR triggers can push unauthorised code or exfiltrate repository secrets.

Verified Remediation Guidance:
# .github/workflows/ci.yml
permissions:
  contents: read
  pull-requests: read

What GitHub Repository Security Detects

Every check is non-destructive, rate-limited, and verified to eliminate false-positive noise.

  • Repositories lacking required pull request reviews, status checks, or signed commits on main branches
  • GitHub Actions workflows vulnerable to script injection or running with write-all GITHUB_TOKEN permissions
  • Former employees or external contractors retaining write/admin access to private repositories
  • Accidental public repository visibility on internal microservices or infrastructure templates
  • Unpinned third-party GitHub Actions (using mutable tags like @v3 instead of full commit SHAs)

How It Works in 3 Steps

01

Install the HackGuardX GitHub App

Grant scoped, read-only metadata and code scanning permissions to selected repositories in 60 seconds.

02

Audit repo governance & CI/CD pipelines

Inspect branch rules, collaborator permissions, workflow YAMLs, and commit history.

03

Lock down engineering hygiene

Apply least-privilege workflow permissions and enforce mandatory review guardrails.

Read our Responsible Testing & Authorisation Policy
Test Your Domain External Posture Now
Safe Passive DNS, TLS & Header Inspection
Non-intrusive public check • Active scanning requires verified ownership
Or test an instant demonstration profile: