Member privileges: visibility changes, deletion and private forks
Why Tier 1
Decides whether repository admins, not only owners, can make repositories public, delete or transfer them, and whether private repositories can be forked. Each one moves code out of the organization's control.
The organization settings for changing repository visibility, deleting or transferring repositories, and forking private repositories.
Available on: Every setup. Source
Attack path
With these left open, a stolen repository admin account can flip a private repository to public, transfer it away or delete it, and a member can fork private code to an account the organization does not control.
Mitigations
- Limit visibility changes, deletion and transfer to organization owners
- Turn off forking of private repositories unless a team needs it
Detect
Alert on repository_visibility_change.enable, members_can_delete_repos.enable, private_repository_forking.enable, repo.access in the audit log.
Related permissions
GitHub Docs: Restricting repository visibility changes in your organization