GitHub repository Severitycritical builtIn

Description

Repository visibility should always be private or internal. Secure your code by converting public repositories to private whenever appropriate. https://docs.github.com/en/enterprise-cloud@latest/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility

Recommandation

1. Go to Repository Settings. 
2. In the 'General' section of the sidebar, go to 'Danger Zone' section. 
3. Under the 'Change repository visibility' section. 
4. Ensure the message 'This repository is currently private/internal.' is displayed.

Règle de politique

{
  "target": "GHRepository",
  "if": {
    "allOf": [
      {
        "resource": "GHRepository",
        "property": "Private",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
Détails de la règle
  • ID de la règle: DOS5050
  • Code: GH_Repository_Visibility_Private
  • Plateforme: GitHub
  • Catégorie: repository
  • Sévérité: Severitycritical
  • Type: builtIn