Decision Center
Repository Security Review
A structured review covering secrets, dependencies, branch protection, CI/CD, repository permissions, CODEOWNERS, signed commits, and automation — answer each question to get a suggested-improvements list, not just a score.
Questions
How to use this reviewAnswer Yes, Partial, or No for each area. A gap answer shows a suggested improvement immediately; answer all eight to see the full summary below.
0 of 8 complete (0%)
Secrets: Does a secret-scanning tool run automatically on every push or pull request?
Dependencies: Are dependencies checked against known CVEs on a recurring basis, not just at initial setup?
Branch Protection: Is the default branch protected against direct pushes and force-pushes?
CI/CD: Are pipeline secrets scoped to the jobs that need them and hidden from fork pull request builds?
Repository Permissions: Is collaborator access reviewed periodically rather than granted once and never revisited?
CODEOWNERS: Does a CODEOWNERS file require review from the right people before merging sensitive paths?
Signed Commits: Are commits to the default branch signed and verified?
Automation: Does a bot or scheduled job keep dependencies and CI tooling versions up to date automatically?
Answer all eight questions above to see the full review summary.