{
  "generatedAt": "2026-10-12T16:01:05.493Z",
  "description": "ghtier maps every way access is granted in GitHub (permissions, roles, scopes and tokens, keys and policies) to one security tier scale (0=Critical..3=Low), and links them to attack paths, incidents and fixes. This manifest lists the static JSON exports available under /data.",
  "files": {
    "permissions.json": "The base layer. Every GitHub App, fine-grained PAT and GITHUB_TOKEN permission at every level (190), each with a tier, a short reason, an area and plane (control, management, data), where it can be granted, the setups it exists on (Free, Team, Enterprise Cloud, Enterprise Managed Users, Enterprise Server; from GitHub's docs data), and sample REST endpoints.",
    "roles.json": "26 built-in GitHub roles (repository, organization, team, enterprise). Each lists the permissions it includes, where each comes from (GitHub's role tables or docs), and a tier inherited from the strongest permission, with the permission that sets it, plus the setups it exists on with the docs page that says so. Also the 70 permissions GitHub lets you add to a custom repository or organization role, each mapped to permissions.",
    "scopes.json": "41 classic PAT and OAuth App scopes. Each lists the permissions it reaches with the evidence (REST endpoints from GitHub's docs that need both), a tier inherited from the strongest one, its sub-scopes and the setups it exists on. Also the kinds of token GitHub issues and the highest tier each can carry.",
    "keys-policies.json": "38 keys and credentials, policies, grants, AI agents and systems outside GitHub, each with its tier, reason, attack path, related permissions, the setups it exists on with any condition, and the audit log events to alert on.",
    "changes.json": "The same history as /changes, newest first: date, kind (permission, role-action, scope, api-version), change (added, removed, changed), name, detail, and a link to the ghtier page.",
    "updates.json": "What was added or changed on ghtier itself, newest first: date, kind (feature, improvement, fix, content, maintenance), one short line, the pages it touched and the PR number.",
    "findings.json": "15 strange findings, places where GitHub access works differently from what most people expect. Each has what people expect, what GitHub does, how to check, how to close it, the permissions, roles, scopes or keys involved, the setups it applies to, and the GitHub docs or changelog source.",
    "graph.json": "The whole site as a graph. Nodes are permissions, roles, attack techniques and objectives, entry vectors, incidents, escalations and checklist items (ids like permission:contents:write); edges say which role includes which permission, which permissions enable each technique, which incidents abused them, which escalation each permission starts and what it gains, and which checklist items mitigate each technique.",
    "permission-model.json": "How the vocabularies fit together. Classic scopes, fine-grained/App permissions, roles, keys and settings; every way access can be granted (25 mechanisms); and a crosswalk of 16 capabilities across classic scope, fine-grained/App permission, GITHUB_TOKEN permission and role.",
    "landscape.json": "The threat landscape, edition 2026-Q4 (reviewed 2026-10-11). Every incident with its OWASP Top 10 CI/CD risks, NIST SP 800-204D sections, plane (control, data, both, platform), first and last seen dates, status and scale; the current trends with the incidents and checklist items behind each; where the frameworks are silent; and the derived flow from way in to objective, the OWASP heatmap by year and the controls that break the most incidents of the last 12 months. Mappings are ghtier's own reading.",
    "scenarios.json": "Real-world incident write-ups (31 scenarios) tagged by plane, with narrative, permissionsAbused, and sources.",
    "checklist.json": "The hardening checklist, grouped by category. Each item has `meta` (the OWASP Top 10 CI/CD risks it addresses, the lowest GitHub plan it works on and any paid add-on, and when it was last checked against GitHub's docs), `detect` (audit log events to alert on when the control is undone), an effort tier, a one-line \"why\", fix steps, prerequisites, a docs link, and for 23 of 47 items a read-only `check` (gh api calls + a jq rule) for testing a real org. Plus the optional Secret Protection and Code Security items (formerly GHAS), each tagged with the license it needs.",
    "assessment.schema.json": "The format of an assessment file (results of running those checks), which /checklist can import.",
    "state-of-github-security.json": "Secret-sprawl, non-human-identity-ratio, and breach-cost stats behind the state-of-security report.",
    "tooling.json": "18 open-source tools for GitHub, CI and supply-chain security in 9 categories. Each has how it works, what it catches, run/CI snippets, what leaves the machine, limits, an editorial rating (1-5), and GitHub stars, license, latest release and OpenSSF Scorecard score as of 2026-10-10. Also a reference PR security pipeline."
  }
}