← All keys & policies
Policy·organization
Base permission: Write or Admin on every repository
Tier 0 · CriticalControl
Why Tier 0
Set to Admin, every member becomes admin on every repository, the same as giving everyone All-repository admin. Set to Write, everyone can change workflows and read secrets everywhere, the same as All-repository write.
The organization's base permission: the repository role every member gets on every repository by default.
Available on: Every setup. Source
Attack path
A single setting quietly gives the whole membership write or admin on every repository, including production. It is a common, easy-to-miss misconfiguration.
Mitigations
- Set the base permission to Read or None
- Grant more per repository or per team instead
Detect
Alert on org.update_default_repository_permission, business.update_default_repository_permission, business.clear_default_repository_permission in the audit log.