Description

Detects when a GitHub organization grants its members write or admin access to every repository by default. The base permission applies to repositories nobody explicitly shared, so each new member reaches code they were never granted, and each new repository is exposed to the whole organization the moment it is created.

Detection Strategy

• Requests the organization's settings once per scan and reads the default repository permission granted to members

• Reports a vulnerability when that permission is write or admin, the two values that grant more than read access

• Names those two values rather than negating read, since none is stricter than read and an organization whose settings the credential cannot read stays silent instead of being reported