Back to Checks
github

Organization repository deletion and transfer is restricted to owners

organization_repository_deletion_limited
Service: organizationSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:GitHubOrganization

Ensure repository deletion/transfer is restricted so only trusted organization users (owners) can delete or transfer repositories.

Prowler logoProwlerprowler-provider-github

Risk

If members can delete or transfer repositories, accidental or malicious deletions can cause irreversible data loss, service disruption, and increased blast radius from compromised accounts.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks organization_repository_deletion_limited

Recommendation

Disable member repository deletion/transfer privileges so only organization owners can delete or transfer repositories.

Remediation

Other

1Sign in to GitHub as an organization owner
2Go to Organization > Settings
3Under "Access", click "Member privileges"
4Disable "Allow members to delete or transfer repositories"
5Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.organization.organization_client import (
    organization_client,
)


class organization_repository_deletion_limited(Check):
    """Check if repository deletion/transfer is limited to trusted organization users."""

    def execute(self) -> List[CheckReportGithub]:
        findings = []
        for org in organization_client.organizations.values():
            members_can_delete = org.members_can_delete_repositories

            if members_can_delete is None:
                continue

            report = CheckReportGithub(metadata=self.metadata(), resource=org)

            if members_can_delete is False:
                report.status = "PASS"
                report.status_extended = f"Organization {org.name} restricts repository deletion/transfer to trusted users."
            else:
                report.status = "FAIL"
                report.status_extended = f"Organization {org.name} allows members to delete/transfer repositories."

            findings.append(report)

        return findings

References