Free tool
GitHub Security Spot Check
Paste a read-only GitHub token and get, in a minute, the branch protection, review, Dependabot, secret-scanning and 2FA status auditors ask about, for every repository, with findings mapped to SOC 2 and ISO 27001.
Runs in your browser; the token goes to api.github.com only · Up to 40 repositories · CSV export
The token stays in this browser tab and is sent only to api.github.com over HTTPS; nothing goes to our servers. Create it at GitHub → Settings → Developer settings → Fine-grained tokens with read-only access to Metadata, Contents, Administration and (for organizations) Members, scoped to the repositories you want checked, with a 1-day expiry. Revoke it when you are done.
| Repository | Visibility | Default branch | Protection or ruleset | Reviews required | Dependabot alerts | Secret scanning | Signed commits (last 20) |
|---|
Findings
What it checks
| Check | Why an auditor cares | Control |
|---|---|---|
| Default branch protection or ruleset | Every change to production code should go through a pull request with enforced rules; direct pushes break the change-management trail. | SOC 2 CC8.1 · ISO 27001 A.8.32 |
| At least one required approving review | Peer review is the control auditors sample most often in change management. | SOC 2 CC8.1 · ISO 27001 A.8.32, A.8.28 |
| Dependabot alerts | Vulnerable dependencies need to be found and fixed within your stated timelines. | SOC 2 CC7.1 · ISO 27001 A.8.8 |
| Secret scanning | Credentials in code are the most common root cause in breach reports we see. | SOC 2 CC6.1 · ISO 27001 A.8.24 |
| Signed commits on the last 20 | Not required by any framework, but evidence of commit provenance where you claim it. | ISO 27001 A.8.28 |
| Organization 2FA requirement | Source control is in scope for the MFA question on every questionnaire. | SOC 2 CC6.1 · ISO 27001 A.8.5 |
How the token is handled
Your browser calls api.github.com directly with the token in the request header. Our site never sees it: there is no server call, no logging, and the field is cleared when you leave the page. Use a fine-grained token with read-only permissions and a short expiry, and revoke it afterwards. The checks that need the Administration permission (protection, alerts, secret scanning) show “No access” when the token does not have it.
Why only GitHub?
Its API can be called directly from the browser, and its tokens are fine-grained enough to be safe for a one-off check. GitLab and Bitbucket checks, and the cloud-console checks (MFA on the AWS root account, S3 public access, CloudTrail), need server-side credentials handling we do during engagements, not on a public page.
Is the result evidence?
The CSV with the date is a snapshot most auditors accept as supporting evidence for the change-management and vulnerability-management controls, alongside screenshots from the settings pages. It is not a substitute for the sampled pull requests they will ask for.
Stuck on a step? Ask us.
Book a free 30-minute consultation. Bring what you have so far and we will tell you what we would do next.