GitHub

What it covers

Org 2FA, branch protection, and Dependabot alerts.

Credential to create

GitHub fine-grained personal access token (or a classic PAT)

Create a fine-grained token

Permissions to grant

• Organization permissions - Members: Read-only (reads the org 2FA-required policy)
• Repository permissions - Administration: Read-only (branch protection)
• Repository permissions - Dependabot alerts: Read-only

Setup steps

1. Create a fine-grained PAT scoped to your organization and the repository you want audited.
2. Grant the three read permissions listed above.
3. On the Integrations page, enter your Organization, Repository, and protected branch (defaults to main), and paste the token.

Notes and gotchas

• The org 2FA-required check only returns a value to a token owned by an organization owner. A non-owner token reads as 'not enforced' and the control fails even on a compliant org, so create the token as an owner.
• A classic PAT works too: scopes read:org and repo.