0git · audit
repo exposure scanner

Make a token for the repo you want to audit

This tool reads a single repository's security configuration through GitHub's API and reports where it's exposed. It only needs to read — create a read-only token scoped to one repo.

recommendedFine-grained token, one repo, read-only

A fine-grained token can be locked to a single repository with read-only permissions, so a leak can't touch anything else. Classic tokens can't be scoped to one repo — this tool will flag a classic token as a finding.

  1. Open github.com/settings/personal-access-tokens/new (Settings › Developer settings › Personal access tokens › Fine-grained tokens).
  2. Set Resource owner to the account or org that owns the repo.
  3. Under Repository access, choose Only select repositories and pick the one repo to audit.
  4. Set an Expiration (7–30 days is plenty for an audit).
  5. Grant the read-only Repository permissions below, then click Generate token and copy it.
    Repository permissions to grant (all Read-only)

    Each maps to part of the audit. Anything you skip is simply reported as skipped — the scan still runs.

    Actions: ReadCI/CD run history — who triggered runs and via what event.
    Administration: ReadBranch protection, rulesets & bypass actors, deploy keys, vulnerability-alert state.
    Code scanning alerts: ReadCodeQL / SAST setup & open alerts.
    Contents: ReadWorkflows, CODEOWNERS, dependabot.yml, commits, releases.
    Dependabot alerts: ReadOpen dependency vulnerabilities.
    Environments: ReadDeployment environments & approval gates.
    Metadata: ReadRequired baseline — visibility, default branch, forking.
    Pull requests: ReadOpen pull requests, including untrusted fork PRs.
    Secret scanning alerts: ReadLeaked-credential alerts (needs GitHub Advanced Security).
    Secrets: ReadNames of Actions secrets (values are never exposed).
    Webhooks: ReadInsecure webhook URLs / missing secrets.

Where your token goes

The token stays in this page's memory for the length of the session, is sent only to api.github.com in the request header, and is never saved to storage or logged. Closing or reloading the tab clears it. Revoke it on GitHub when you're done.

Connect and test

Paste your token and the repository. Nothing is scanned yet — this just confirms the token works and shows what access it has.

e.g. RogueValley/AI_Pirates or tester/test — or paste the full URL like https://github.com/RogueValley/AI_Pirates
e.g. github_pat_282AFSA... (fine-grained) or ghp_... (classic)

Scanning

Reading the repository's configuration and validating each control. This makes read-only API calls only.