Deliver a fixed-price security engagement that inventories GitHub identities, tokens, secrets, Actions workflows, third-party actions, branch protections, runner configurations, agent permissions, and possible exfiltration channels. The operator validates practical attack paths, rotates exposed credentials with the client, removes persistence mechanisms, hardens workflows and runners, and provides tested repository policies. Recurring monitoring and quarterly reassessments can follow the initial remediation sprint.

The signals describe repeated attacks beginning with GitHub Actions access, compromised laptops, exposed tokens, or coding agents with broad shell and network permissions. Autonomous coding tools create additional credential-access and exfiltration paths, making repository security a distinct operational requirement rather than a routine code scan.