Back to Checks
github

Organization base repository permission is read or none

organization_default_repository_permission_strict
Service: organizationSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

GitHub organization base repository permission for members uses a strict setting such as read or none rather than permissive options like write or admin. Applies to members, not outside collaborators.

Prowler logoProwlerprowler-provider-github

Risk

Excessive default permissions (write/admin) erode code integrity and availability.

Any member-or a compromised account-can alter many repos, inject malicious commits, change tags/releases, or delete branches, enabling supply-chain compromise and large-scale disruptions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks organization_default_repository_permission_strict

Recommendation

Apply least privilege: set base permission to none or read.

Grant higher access explicitly via teams per repo and enforce separation of duties with required reviews and branch protection. Regularly audit memberships and access to limit blast radius and maintain defense in depth.

Remediation

Terraform

resource "github_organization_settings" "<example_resource_name>" {
  default_repository_permission = "read" # Critical: sets the org's base repository permission to a strict level (read/none passes)
}

Other

1Sign in to GitHub as an organization owner
2Go to the organization > Settings
3Under "Access" in the sidebar, click "Member privileges"
4Under "Base permissions", select "Read" (or "None")
5Click "Change default permission" to confirm

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.organization.organization_client import (
    organization_client,
)


class organization_default_repository_permission_strict(Check):
    """Check if an organization's base repository permission is set to a strict level.

    PASS: base permission is "read" or "none"
    FAIL: base permission is "write" or "admin" (or any other non-strict value)
    """

    def execute(self) -> List[CheckReportGithub]:
        findings = []
        for org in organization_client.organizations.values():
            base_perm = getattr(org, "base_permission", None)
            if base_perm is None:
                # Unknown / no permission to read → skip producing a finding
                continue

            p = str(base_perm).lower()
            report = CheckReportGithub(metadata=self.metadata(), resource=org)

            if p in ("read", "none"):
                report.status = "PASS"
                report.status_extended = f"Organization {org.name} base repository permission is '{p}', which is strict."
            else:
                report.status = "FAIL"
                report.status_extended = f"Organization {org.name} base repository permission is '{p}', which is not strict."

            findings.append(report)

        return findings

References