GitHub
Code quality
Security & compliance
Releases
Repository protection posture
Confirms the safeguards you think are on are actually on.
Overview
Reads the live GitHub API for your connected repository: branch protection rules, required reviews, Actions permissions, and the security toggles. This is posture as GitHub reports it, not as your settings page was left months ago.
What it looks for
- Unprotected default branch, or protection with no required reviews
- Force-push allowed, commit signing not required
- Actions configured to allow all third-party actions
- Secret-scanning push protection and Dependabot security updates disabled
- Organisation not enforcing two-factor authentication
- Archived or long-dormant repositories still connected as production
Why it matters
Branch protection that was never enabled, or was relaxed for one urgent fix and never restored, is invisible until someone force-pushes over main. Secret-scanning push protection is the difference between a leaked key and a blocked commit.
Rules in this check
| What it reports | Fix path |
|---|---|
| Default branch is unprotected | Guide |
| Branch protection too weak | Guide |
| Commit signing not required | Guide |
| GitHub Actions allows all third-party actions | Guide |
| Secret-scanning push protection disabled | Guide |
| Dependabot security updates disabled | Guide |
| Connected repo is archived | Guide |
| No pushes for 90+ days on a scanned production repo | Guide |
| Delete-branch-on-merge disabled | Guide |
| Org does not require two-factor authentication | Guide |
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.