Description

Detects when a GitHub organization does not require two-factor authentication from its members. A single stolen or reused password is then enough to reach the organization's repositories, and the accounts that hold write access are exactly the ones an attacker needs to alter code before it ships.

Detection Strategy

• Requests the organization's settings once per scan and reads whether two-factor authentication is required of members

• Reports a vulnerability when the requirement is disabled

• Leaves the setting unread rather than assumed when the credential is not an organization owner, since GitHub returns null in that case and a missing answer must not be reported as a missing control