GitHub 34 rules 6 checks

GitHub repo security checks

Branch protection that blocks what it should, secrets that get rotated instead of ignored, workflows that cannot leak more than they need. These are the rules lumioguard runs against a connected GitHub repo.

GitHub 7 rules

Actions supply chain

Your CI runs third-party code with your secrets attached.

ReleasesSecurity & complianceStability Open
GitHub 4 rules

Env & config hygiene

Whether a new environment can be brought up from the repo alone.

ReleasesCode qualitySecurity & compliance Open
GitHub 6 rules

Release & branch safety

What stands between a push and a production release.

ReleasesCode qualitySecurity & compliance Open
GitHub 10 rules

Repository protection posture

Confirms the safeguards you think are on are actually on.

Code qualitySecurity & complianceReleases Open
GitHub 4 rules

Secret hygiene

Credentials committed to the source tree.

Code qualitySecurity & compliance Open
GitHub 3 rules

Supply-chain alerts

The GitHub security alerts nobody has opened.

Security & complianceCode qualityReleases Open

Every GitHub rule

Actions supply chain

7 rules
Third-party action pinned to mutable tag GitHubActions supply chain Pull_request_target with PR-head checkout (pwn-request) GitHubActions supply chain Secret value echoed in run step GitHubActions supply chain Workflow missing permissions block GitHubActions supply chain Script injection via github.event expression in run step GitHubActions supply chain CI pipeline failing repeatedly GitHubActions supply chain A specific workflow failing repeatedly GitHubActions supply chain

Env & config hygiene

4 rules
Missing .env.example GitHubEnv & config hygiene Config value hardcoded instead of env var GitHubEnv & config hygiene Env vars used in code but missing from .env.example GitHubEnv & config hygiene Production config file with hardcoded values GitHubEnv & config hygiene

Release & branch safety

6 rules
No CODEOWNERS file GitHubRelease & branch safety No CI workflows — no status checks to gate merges GitHubRelease & branch safety Production deploy job without environment protection GitHubRelease & branch safety Automated release triggered on every push without a tag/release guard GitHubRelease & branch safety Package publish token passed as CLI argument (log-visible) GitHubRelease & branch safety No Dependabot config — dependency updates not automated GitHubRelease & branch safety

Repository protection posture

10 rules
Default branch is unprotected GitHubRepository protection posture Branch protection too weak GitHubRepository protection posture Commit signing not required GitHubRepository protection posture GitHub Actions allows all third-party actions GitHubRepository protection posture Secret-scanning push protection disabled GitHubRepository protection posture Dependabot security updates disabled GitHubRepository protection posture Connected repo is archived GitHubRepository protection posture No pushes for 90+ days on a scanned production repo GitHubRepository protection posture Delete-branch-on-merge disabled GitHubRepository protection posture Org does not require two-factor authentication GitHubRepository protection posture

Secret hygiene

4 rules
Hardcoded provider API token GitHubSecret hygiene Committed .env file GitHubSecret hygiene Committed private key or certificate GitHubSecret hygiene Missing .gitignore coverage for env files GitHubSecret hygiene

Supply-chain alerts

3 rules
Known-vulnerable dependency (Dependabot) GitHubSupply-chain alerts Open code-scanning (SAST) alert GitHubSupply-chain alerts Active leaked secret (secret scanning) GitHubSupply-chain alerts

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.

Start for Free View pricing