GitHub Repository Visibility Changed To Public

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•1•0•34

Detects when a GitHub repository's visibility is changed from 'internal' to 'public'. This change can expose sensitive code or data, potentially leading to data exfiltration or unauthorized access. The rule specifically looks for 'repo.access' events where the 'previous_visibility' was 'internal' and 'public_repo' is now 'true'.