Team Coverage
-
Repos with at least one team grant
Free GitHub access audit
See team coverage, direct repository grants and access that needs a closer look.
Start with read-only access. No account or payment is needed for first results, and repod does not clone your code.
- You must be a member of the GitHub organisation.
- Use a fine-grained token with Members: Read, Organisation Administration: Read and Repository Metadata: Read.
- Your organisation may require an owner to approve the token. Select all repositories, or the subset you want audited.
- To check direct grants, the token owner must already have Write, Maintain or Admin access on each repository. The token itself can remain read-only.
View example results without connecting GitHub
How to create and approve a read-only token
Read access is enough for this health check: orgs, repos, teams, team membership, and team-repo permissions. Organization -> Administration: Read is required so repod can detect base org repository permission; without it this field may show UNKNOWN. Write access is only needed later if you want repod to apply changes. We encrypt tokens at rest, keep this public audit session for 24 hours unless you claim it sooner, and do not keep unclaimed audits on a recurring sync loop.
How to Create It
- In GitHub, open Settings then Developer settings.
- Open Personal access tokens, then Fine-grained tokens.
- Click Generate new token.
- Select the target org as the Resource owner.
- Choose the repo access and permissions above, then generate the token.
The token owner must already be a member of the org. If your org requires approval for fine-grained PATs, an org owner must approve the token before repod can read private org data.
Fine-grained PAT for This Audit
| Area | Permission | Level |
|---|---|---|
| Organization | Members | Read |
| Organization | Administration | Read (required) |
| Repository | Metadata | Read |
| Repository | Access | All repositories, or the repos you want audited |
No write permission required for the free audit. Required: Organization -> Administration must be Read so base repository permission is detected (otherwise it can appear as UNKNOWN). Apply/fix actions can ask for Repository -> Administration: Write later.
Tokens are encrypted at rest. Unclaimed audits expire after 24 hours and do not run recurring syncs. A selected subset is not a complete organisation audit.
Audit Status
Idle
Private Unassigned
-
Private repos with zero team grants
Direct Staff Mappings
-
User-to-repo grants outside team access
Direct-Only Repos
-
Repos with direct user grants but no team grants
High-Privilege Teams
-
Teams with maintain/admin on at least one repo
Instant GitHub Access Governance Preview
Preview Findings
| Signal | Finding | Why it matters |
|---|