audit-labs/audit-tools
A collection of scripts, queries, and other goodies you can use in an audit.
clone: git clone https://gitbay.org/audit-labs/audit-tools.git
4c62f858355e63b7bc9f60c4a2961a2939222099
signed_unknown_key
author: Christian Cleberg <hello@cleberg.net> · 2026-07-29T16:58:24Z
committer: <noreply@github.com>
applications/github/README.md | 2 +- .../github/collectors/branch_protections.py | 160 ++++++++++++++------- tui/tests/test_branch_protections.py | 109 ++++++++++++++ 3 files changed, 218 insertions(+), 53 deletions(-) @@@ -47,13 -44,8 +47,13 @@@ Creates a directory: `<out>/github_audi | `pending_invitations.csv` | Invitations not yet accepted, with age in days | | `team_permissions.csv` | Teams, their repos, permissions, and members | | `permission_matrix.csv` | Full user/repo/permission cross-reference | - | `branch_protections.csv` | Branch protection settings across all repos | + | `branch_protections.csv` | Per-branch protection across all repos, from classic branch protection **and** rulesets (`protection_source` records which) | | `commits.csv` | Commit history across all repos for the target branch | +| `org_security.csv` | Org security settings (2FA requirement, default permission, repo creation, secret scanning defaults) | +| `webhooks.csv` | Org and per-repo webhooks, flagging plain-HTTP delivery and disabled SSL verification | +| `deploy_keys.csv` | Deploy keys across all repos (read-only vs read-write, last used) | +| `secret_scanning.csv` | Open secret-scanning alerts (Advanced Security) | +| `dependabot_alerts.csv` | Open Dependabot alerts with severity (Advanced Security) | | `audit_log.csv` | Branch protection and repository ruleset audit-log changes from the last 180 days (Enterprise Cloud only) | | `summary.txt` | Row counts per section |