Loading

Loading...

Back to Documentation

Security PolicyGHA-SEC003

GHA-SEC003Minimally Scoped Credentials

Problem Statement

GITHUB_TOKEN is granted all permissions by default.

Vulnerability

Privilege Escalation and Unauthorized Actions

Code Examples

Insecure Implementation

# No permissions block

Secure Implementation

permissions:
  contents: read
  issues: write

Remediation Steps

Explicitly define the minimum required permissions in each workflow.
Start with zero permissions and incrementally add only necessary ones.