GitHub

What it covers

Org 2FA, branch protection, and Dependabot alerts.

Credential to create

GitHub fine-grained personal access token (or a classic PAT)

Create a fine-grained token

Permissions to grant

• Organization permissions - Members: Read-only (reads the org 2FA-required policy)
• Repository permissions - Administration: Read-only (branch protection)
• Repository permissions - Dependabot alerts: Read-only
• Repository permissions - Contents: Read-only (lets us cite your Terraform, Helm charts and Kubernetes manifests as evidence)

Setup steps

1. Create a fine-grained PAT scoped to your organization and the repository you want audited.
2. Grant the four read permissions listed above.
3. In the form below, enter your Organization, Repository, and protected branch (defaults to main), and paste the token.

Notes and gotchas

• The org 2FA-required check only returns a value to a token owned by an organization owner. A non-owner token reads as 'not enforced' and the control fails even on a compliant org, so create the token as an owner.
• A classic PAT works too: scopes read:org and repo.
• Contents: Read-only is what lets a configuration control be evidenced by the code that sets it, which is stronger than a screenshot of a console: the Terraform is what recreates the setting tomorrow. Without it, everything else still works and we say the code was unreadable rather than guessing.
• Infrastructure often lives in its own repository. Leave "Other repositories" empty and we read whichever ones your token can see, so the token's own repository selection is the boundary; name repositories there to narrow it further. The 2FA, branch-protection and Dependabot checks always run against the repository you named above.
• We only ever read infrastructure and policy files (Terraform, Helm, Kubernetes manifests, Dockerfiles, CI workflows, CODEOWNERS, SECURITY), never your application source. Paths that commonly hold credentials (.env, *.pem, secrets.tfvars, terraform.tfstate, .ssh) are refused outright, and any file that scans as containing a secret is discarded unread rather than stored as evidence.