Check organization security settings: 2FA enforcement, default repository visibility, member privileges. Detects ORG-001, ORG-002, ORG-003.

Check if SSO/SAML single sign-on is configured for the organization. Detects ORG-004.

Audit organization members: outside collaborators and member activity. Detects ORG-005, ORG-006.

Audit OAuth app authorizations and GitHub App installations for the organization. Detects ORG-007, ORG-008.

Check organization webhooks for insecure HTTP URLs and SSL verification. Detects ORG-009.

Review organization audit log for suspicious or high-risk events. Detects ORG-010.

List organization repositories with security metadata (visibility, fork count, archived status). Useful for selecting repos to audit.

Check branch protection rules on the default branch: required reviews, status checks, admin enforcement, signed commits. Detects REPO-001.

Check if secret scanning and push protection are enabled for the repository. Detects REPO-002, REPO-003.

Check if code scanning (CodeQL) is configured and review open alerts. Detects REPO-004, REPO-005.

Check Dependabot configuration and open security alerts. Detects REPO-006, REPO-007.

Check repository security settings: SECURITY.md, private vulnerability reporting, fork restrictions. Detects REPO-008, REPO-009, REPO-010.

Check repository webhooks for insecure HTTP URLs and SSL verification. Detects REPO-011.

Audit deploy keys for unnecessary write access. Detects REPO-012.

Check if CODEOWNERS file exists for code review enforcement. Detects REPO-013.

Scan workflow files for script injection vulnerabilities via untrusted event inputs (${{ github.event.issue.title }}, etc. in run: blocks). Detects ACT-001.

Detect dangerous pull_request_target + checkout pattern that enables arbitrary code execution from fork PRs. Detects ACT-002.

Check GITHUB_TOKEN default permissions (should be read, not write). Detects ACT-003.

Detect unpinned third-party actions (tag reference vs SHA pinning). Detects ACT-004.

Detect self-hosted runners and assess persistence/exposure risk. Detects ACT-005.

Check deployment environments for missing protection rules (reviewers, wait timers, branch policies). Detects ACT-006.

Detect patterns where secrets are passed to network commands (curl/wget) or logged in workflow files. Detects ACT-007.

Check OIDC subject claim customization for secure cloud deployment trust. Detects ACT-008.

Check secret scanning coverage and review open alerts. Detects SEC-001, SEC-002.

Check for secret scanning alerts where push protection was bypassed. Detects SEC-003.

Check if organization has defined custom secret scanning patterns. Detects SEC-004.

Review secret scoping across environments, repositories, and organization levels. Detects SEC-005.

Check if the dependency graph is enabled for vulnerability detection. Detects SUP-001.

Check if Dependabot security updates and version updates are configured. Detects SUP-002.

Check if software bill of materials (SBOM) can be generated from the dependency graph. Detects SUP-003.

Check for critical known vulnerabilities and stale unfixed alerts (>90 days). Detects SUP-004, SUP-005.

Audit team permissions for admin-level access to repositories. Detects ACC-001.

Check for outside collaborators with write, maintain, or admin permissions. Detects ACC-002.

Audit GitHub App installations for overly broad permission scopes. Detects ACC-003.

Check for classic personal access tokens with overly broad scopes. Detects ACC-004.

List all available security checks with their IDs, categories, severities, and descriptions. Filterable by category and severity.

Aggregate all findings from the current session by category, severity, and status. Shows critical findings and top remediation actions.

Generate a comprehensive markdown security report from all findings in the current session.

Run all security checks for an organization and/or repository. Executes org, repo, actions, secrets, supply chain, and access control checks sequentially.