Excessive GitHub App permissions

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_97
Category	Supply Chain
Severity	HIGH

Impact

A GitHub App with 'write' permissions to an organization that has not performed any actions requiring 'write' permissions for more than 30 days may not require these permissions. This poses a threat, as attackers who gain control of the GitHub App can potentially access the organization and its repositories, thereby enlarging the surface of the attack.

Recommended Solution - Buildtime

If the GitHub App is not in use, delete the app from the organization. If the app is in use, but is not using its granted write permissions, consider asking the app creator to reduce the requested permissions to read.

📌 NOTE App creators, not organization admins, control the level of permission granted to GitHub Apps.