Checklist

Every fix from Best Practices, organized by category and ordered by return on investment. The highest-impact, lowest-effort items come first in each section. Checking an item off is saved locally in your browser. Each item's Why badge explains why it matters and, where one applies, links to the real incident it would have prevented.

0 of 47 done

Click any item to see how to fix it. Fill in your names below and every link and command in the fixes updates to point at them. Nothing leaves your browser.

OrganizationEnterpriseRepository

Check your own organization

Run the read-only checks with your own gh login, then import the result here to fill in the checklist. Your data stays on your machine. Use the ghtier-assess skill with your agent, or run assess.mjs yourself:

node assess.mjs --org my-org

Authentication & identity0/8

Organization governance0/13

Repository security0/10

CI/CD & GitHub Actions0/16

Authentication & identity

0/8

Quick win · under an hour
Quick win · under an hourEnterprise Server
Quick win · under an hour
Quick win · under an hour
Moderate · plan for this quarter
Moderate · plan for this quarter
Larger initiative · weeksEnterprise
0%
Larger initiative · weeksEnterprise

Repository security

0/10

0%
Quick win · under an hourTeam
0%
Quick win · under an hourTeam + Secret Protection
0%
Quick win · under an hour
0%
Quick win · under an hourTeam
Quick win · under an hour
0%
Moderate · plan for this quarterTeam
0%
Moderate · plan for this quarterTeam
0%
Moderate · plan for this quarterTeam
Larger initiative · weeksEnterprise
0%
Quick win · under an hour

Optional: Secret Protection and Code Security

0 of 6 in use

These are paid features layered on top of everything above. They're not required to be secure, but they're the highest-leverage upgrade once the free checklist is done. Check off what your organization already has turned on.

GitHub sells them as two products, GitHub Secret Protection and GitHub Code Security, which replaced GitHub Advanced Security (GHAS) in 2025. Each item shows which one it needs. GitHub Changelog

Secret ProtectionDetects known secret patterns (cloud keys, tokens, credentials) committed anywhere in private or internal repositories.
Secret ProtectionBlocks a git push containing a detected secret before it ever reaches repository history, instead of just alerting after the fact.
Code SecurityRuns static analysis against every push and pull request to catch injection flaws, unsafe deserialization, and other code-level vulnerabilities before merge.
Code SecuritySurfaces vulnerable or license-risky dependency changes directly in the PR diff, before a risky version ever gets merged in.
Code SecurityAn org-wide dashboard aggregating alerts across every repository, with the ability to launch a prioritized, assignable remediation campaign against them.
Code SecurityGenerates an AI-suggested, one-click fix for a CodeQL finding directly on the pull request, cutting remediation time on the alerts you do have.

Checklist

Check your own organization

Start here

Authentication & identity

Organization governance

Repository security

CI/CD & GitHub Actions

Optional: Secret Protection and Code Security