GitHub Branch Protection and Access Permissions Review (Defensive)
Check who can change what.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Review repository permissions as a defensive review of my own organisation's repositories. Teams and members with roles (read, triage, write, maintain, admin): [ACCESS_LIST]. Branch protection rules on the default and release branches: [PROTECTION_RULES]. Deploy keys, tokens and apps with access: [INTEGRATIONS]. Our policy: [POLICY]. Check for too many admins, direct pushes to protected branches, missing required reviews or status checks, force push allowed, leavers still listed, outside collaborators, tokens with broad scope or no expiry, apps with write access, and secrets accessible to all workflows. For each finding give the realistic consequence, for example 'anyone with write access could push unreviewed code to production', the smallest change that removes it, and the risk and effort. Provide a proposed rules table for the default branch: require pull requests, at least one approving review, status checks passing, dismiss stale approvals on new commits, no force pushes, no deletion, and restricted pushes for release branches [VERIFY setting names]. Show an access model by role (who, what they can do, why) and count admins before and after. Define an emergency procedure so changes do not block urgent fixes: a named person may bypass, it is recorded in the incident ticket, and it is reviewed within 24 hours. Introduce stricter rules gradually: announce, apply to one repository, review after two weeks, testing on a throwaway branch. Add a quarterly review. Never ask me to paste tokens or keys.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.