Organization role·The organization and every repository in it

Security manager

Tier 1 · HighManagement

Why Tier 1

Tier 1 because it includes Secret scanning alerts: Read (repository), Administration: Write (organization) (in part).

Manages security policies, alerts and configurations across the organization.

Available on: Every setup. Source

Permissions it includes (17)

Tier	Permission	From
T1sets tier	Administration: Writeorganization In part, counts as T1 (the full permission is T0): Security configurations for every repository. Can switch secret scanning, push protection and code scanning off org-wide.	Manage security and analysis settings inferred
T1sets tier	Secret scanning alerts: Readrepository	Security managers can view and manage security alerts in every repository in the organization. documented
T2	Administration: Writerepository In part, counts as T2 (the full permission is T1): Can turn automated security fixes off.	Manage Dependabot security updates inferred
T2	Organization dismissal requests for code scanning: Writeorganization	Review and manage code scanning dismissal requests documented
T2	Organization dismissal requests for Dependabot: Writeorganization	Review Dependabot alert dismissal requests Bypass Dependabot alert dismissal requests documented
T2	Organization bypass requests for secret scanning: Writeorganization	Review and manage secret scanning bypass requests documented
T2	Repository creation: Writerepository	Create repositories documented
T2	Secret scanning alerts: Writerepository	Security managers can view and manage security alerts in every repository in the organization. documented
T2	Secret scanning alert dismissal requests: Writeorganization	Review and manage secret scanning dismissal requests documented
T2	Code scanning alerts: Writerepository	Security managers can view and manage security alerts in every repository in the organization. documented
T2	Dependabot alerts: Writerepository	Security managers can view and manage security alerts in every repository in the organization. documented
T3	Contents: Readrepository	Pull (read) all repositories in the organization documented
T3	Issues: Writerepository In part, counts as T3 (the full permission is T2): Moderation on repositories they can already write to.	Hide comments on writable commits, pull requests, and issues Hide comments on all commits, pull requests, and issues inferred
T3	Members: Readorganization	See all organization members and teams documented
T3	Members: Writeorganization In part, counts as T3 (the full permission is T0): Creates a team. Giving it repository access needs a repository admin.	Create teams inferred
T3	Code scanning alerts: Readrepository	View security overview for the organization documented
T3	Dependabot alerts: Readrepository	View security overview for the organization Receive Dependabot alerts about insecure dependencies for all of an organization's repositories documented

Attack paths

Techniques it enables

Clone private repos with a stolen token Read or expose private code · through Contents: Read
Get an agent to copy private code into public Read or expose private code · through Contents: Read

Escalations it starts

Harvest leaked secrets from scanning alerts: Live credentials found in code and history: cloud keys, tokens and passwords, often for systems outside GitHub. · through Secret scanning alerts: Read

Abused in

GitHub's internal repositories taken through a VS Code extension Shai-Hulud self-propagating worm (1.0 & 2.0)GitHub MCP / agentic token breadth OAuth consent phishing at scale Mercedes-Benz source code exposure Heroku / Travis CI OAuth token theft

Abilities with no matching permission

These do not affect the tier.

@mention any visible team (Notifications only.)
Can be made a team maintainer (Eligibility, not a grant. See the Team maintainer role.)
Sponsor accounts and manage the organization's sponsorships (Sponsorships and payments only.)

GitHub Docs for this role