Personal access token policy
Why Tier 1
Decides whether members' classic and fine-grained tokens can reach the organization at all, and whether fine-grained tokens need an owner's approval. Opening it lets any member's leaked token act on the organization's repositories.
The organization setting that allows or restricts classic personal access tokens and fine-grained tokens, and whether fine-grained ones need approval.
Available on: Every setup. Source
Attack path
With classic tokens allowed and no approval for fine-grained ones, every token a member ever created works against the organization. A token leaked from a laptop or CI log then needs nothing else.
Mitigations
- Restrict classic tokens and require approval for fine-grained ones
Detect
Alert on personal_access_token.access_restriction_disabled, auto_approve_personal_access_token_requests.enable, personal_access_token.expiration_limit_unset in the audit log.
Related permissions
GitHub Docs: Setting a personal access token policy for your organization