GitHub Organization secret not scoped

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_178
Category	Credential Hygiene
Severity	MEDIUM

Impact

In GitHub organizations where secrets are not scoped to specific repositories and GitHub Actions is enabled, a malicious actor who has access to the organization could access these secrets by creating a workflow or modifying an existing workflow. This creates a security risk, as sensitive information could be exposed to unauthorized parties.

Recommended Solution - Buildtime

It’s important to scope organization secrets to specific repositories and grant permission on a need-to-access basis only, following the principle of least privilege.

To change the scope of a GitHub organization secret:

1. Browse to the Settings tab of your GitHub organization’s repository where the secret is located.
2. Click on the Secrets menu located in the left-hand side of the page.
3. Select the required secret and click on its name to open the details page.
4. Click on the Edit button on the top right-hand corner of the page.
5. Under Repository access, select the repositories that should have access to the secret.
6. Click on the Update secret button to save the changes.

For more information refer to https://docs.github.com/en/enterprise-cloud@latest/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization.