← All keys & policies
Grant·repository
Code owner (CODEOWNERS entry)
Tier 2 · MediumData
Why Tier 2
A code owner's approval satisfies review for their paths. Whoever can edit CODEOWNERS on the protected branch chooses who approves.
A person or team named in CODEOWNERS whose review is required for the paths they own, when the branch requires code owner review.
Available on: Free (public repositories only), Team, Enterprise Cloud, EMU, Server. Source
Attack path
Code owner approval is a grant written in a file. Anyone who can change CODEOWNERS on the protected branch decides who may approve, so the file needs its own owner. A wildcard entry that names a large team makes any member's approval enough.
Mitigations
- Make CODEOWNERS itself owned by a small security or platform team
- Cover .github/workflows/ with a specific owner
Detect
Alert on protected_branch.update_require_code_owner_review, git.push in the audit log (the closest events GitHub logs).