Know who can do what in your GitHub, and close the paths attackers use.
ghtier maps every way access is granted in GitHub, from enterprise roles to a single workflow token, and tiers each one by what an attacker could do with it. That map is the foundation for everything else: tracing real attack paths through an organization, removing privilege escalation routes, and raising the security maturity of the platform step by step.
The tier model
- T0Tier 0: Control-plane equivalent. Full compromise of an org, enterprise, or app identity, or of every repository in it.
- T1Tier 1: Management/pipeline plane. Control over deployments, CI/CD, or secrets.
- T2Tier 2: User/workload plane. Real but bounded risk: standard collaboration, or stopping work by cutting spend or licenses.
- T3Tier 3: Low impact. Reading, or changes that touch no access, code, credentials or availability.
From permissions to maturity
- 1
Understand the permissions
Every role, token, App and key in GitHub, tiered by blast radius, with the vocabularies that tie them together. Start here to see what a grant really allows.
- 2
Trace the attack paths
How attackers get in and what they go after, built from real incidents. Each step points back to the permission it abuses, so a path becomes a list of grants to remove.
- 3
Fix and mature
Close privilege escalation routes first, then raise the baseline across identity, organization settings, repositories and CI/CD. Check a real organization against it.