​
More Info:

Having too many owners of a Git organization increases the risk of a serious compromise from lost credentials.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

​
Remediation

​
Using Console

The excessive number of owners in a GitHub repository is not a misconfiguration, but it is not recommended to have too many owners as it can lead to security risks. However, if you want to remediate this, you can follow these steps:

  1. Open the GitHub repository in your web browser.
  2. Click on the “Settings” tab at the top of the repository page.
  3. In the left sidebar, click on “Manage access”.
  4. You should see a list of all the people and teams that have access to the repository. Identify the owners that you want to remove.
  5. Click on the gear icon next to the owner’s name and select “Remove”.
  6. Confirm that you want to remove the owner by clicking on “Remove” again.

Repeat these steps for all the owners that you want to remove. It’s important to note that removing an owner will revoke their administrative access to the repository, so make sure you only remove the owners that you no longer want to have administrative access.

​
Using CLI

To remediate the excessive number of owners issue in GITHUB using GITHUB CLI, you can follow the below steps:

  1. Open your terminal or command prompt and install the GitHub CLI by following the instructions provided here: https://cli.github.com/manual/installation

  2. Once the installation is complete, authenticate yourself to GitHub using the following command:

gh auth login

  1. Select the appropriate authentication method and follow the prompts to complete the authentication process.

  2. After successful authentication, run the following command to list all the repositories that you have access to:

gh repo list
  1. Select the repository that you want to remediate and run the following command to clone the repository to your local machine:
gh repo clone <repository-name>
  1. Navigate to the cloned repository and run the following command to list all the collaborators:
gh repo view --json collaborators
  1. Identify the excessive number of owners from the list of collaborators and remove them using the following command:
gh repo remove-collaborator <username>

  1. Replace <username> with the username of the excessive owner that you want to remove.

  2. Confirm the removal by following the prompts.

  3. Once the removal is complete, push the changes to the remote repository using the following command:

git push
  1. Verify that the excessive owner has been removed by running the following command:
gh repo view --json collaborators
  1. If the excessive owner has been successfully removed, you have remediated the excessive number of owners issue in GITHUB using GITHUB CLI.

​
Using Python

To remediate the excessive number of owners misconfiguration in GitHub using Python, you can follow the below steps:

Step 1: Install the PyGithub library

pip install PyGithub

Step 2: Create a GitHub API token with the appropriate permissions to access and modify the repositories.

Step 3: Use the following Python code to remediate the excessive number of owners misconfiguration:

from github import Github

# Replace with your GitHub API token
g = Github('API_TOKEN')

# Replace with the repository name and owner
repo = g.get_repo('OWNER/REPO_NAME')

# Get the current number of owners
current_owners = repo.get_collaborators(affiliation='owner')
num_owners = len(list(current_owners))

# Set the desired number of owners
desired_num_owners = 1

# If there are too many owners, remove the excess owners
if num_owners > desired_num_owners:
    excess_owners = list(current_owners)[desired_num_owners:]
    for owner in excess_owners:
        repo.remove_from_collaborators(owner)

# If there are too few owners, add new owners
elif num_owners < desired_num_owners:
    # Replace with the GitHub usernames of the desired owners
    new_owners = ['NEW_OWNER_USERNAME']
    for owner in new_owners:
        repo.add_to_collaborators(owner, 'admin')

This code uses the PyGithub library to connect to the GitHub API and retrieve the current list of owners for a specified repository. It then checks whether the number of owners is greater than or less than the desired number and adds or removes owners accordingly. You can customize the code by replacing the API token, repository name and owner, desired number of owners, and new owner usernames as needed.

​
Additional Reading: