GitHub Repository Security Scanner

Audit your GitHub repository's security posture — branch protection, secret scanning, access, webhooks and deploy keys.

How this scan works

Public repo, no token: repository visibility, and whether SECURITY.md and CODEOWNERS exist
With an admin-scoped token or the connected GitHub App: default-branch protection graded on what it actually requires (approving reviews, status checks, force-push and deletion blocks, signed commits) — not merely whether a rule exists
Secret-scanning alerts and push-protection status, default GITHUB_TOKEN permissions (read vs write), and open Dependabot alerts by severity
Access paths most audits miss: repository webhooks with TLS verification off or no signing secret, deploy keys that grant write, and outside collaborators holding write or admin
Deployment environments with no required reviewer and no branch restriction — the workflow-readable path to your production secrets
Organization-level 2FA enforcement, when the token can see it
Token-scope gaps degrade to an informational note — never a false-positive failure. GitHub returns 404 for "you can’t see this" and "this isn’t configured" alike, so a negative verdict is only rendered when the token demonstrably has admin