Home / GitHub security hardening
Service
Lock down your GitHub in days, not quarters
Most repository compromises use a leaked token, an over-permissioned workflow, or a third-party action that changed underneath you. We audit your GitHub organisation, fix what's exposed, and document every change, for a fixed price agreed before we start.
What gets fixed
- Branch protection on default branches: required reviews and checks, no force-pushes, rules applied to admins.
- Secret scanning and push protection, plus rotation of anything already exposed.
- Read-only default workflow token and least-privilege permissions per job.
- Third-party Actions pinned to full commit SHAs, with Dependabot keeping them current.
- OIDC for cloud deployments instead of long-lived keys stored in GitHub.
- CODEOWNERS on workflows and sensitive paths; environments with required reviewers for production deploys.
- Organisation-wide two-factor authentication and an allow-list of permitted Actions.
The full list, with commands, is in our GitHub hardening checklist, so you can check our work or do it yourself.
What you receive
- A written report: every finding, what changed, what needs your decision.
- A repeatable baseline (workflow templates, Dependabot and CODEOWNERS files) for new repositories.
- A short handover call so your team knows how each protection is enforced.
How it works
- Discover. A free call and read-only audit.
- Scope. A fixed price and a list of changes, in writing, within 48 hours.
- Build. We apply changes with scoped, time-limited access and open pull requests for anything that touches your code.
- Handover. The report, the baseline and a call. Access is removed.
Frequently asked questions
What does the hardening cover?
An audit of every repository, organisation setting and access grant, then fixes for branch protection, secret scanning and push protection, workflow permissions, pinned third-party actions, dependency updates and access control.
Do you need write access to my repositories?
We start with read access for the audit. For fixes we request the minimum admin access needed, scoped and time-limited, and document every change.
What do I receive at the end?
A written report listing every finding, what was changed, what still needs your decision, and how to keep each setting enforced.
Is it a fixed price?
Yes. The price is set in writing after the discovery call, before any work begins.
What if you find a leaked secret?
We tell you immediately. Any secret that has been committed should be treated as compromised and rotated; removing the commit does not undo the exposure.