Your team has been on GitHub for years. Engineers join, get added to repos, move teams, get promoted, sometimes leave. Access piles up quietly.

Here's a question most engineering leads can't answer without clicking through a dozen GitHub settings pages:

Who has admin access to your production repos right now?

Not who should. Who does.

I spent the last few weeks building a tool to answer that — and then ran it against a few orgs (with permission). What I found was uncomfortable enough that I'm writing this post.

The access drift problem

GitHub's access model is powerful but silent. There's no built-in alert when:

• An engineer who left 6 months ago still has write access to your main repo
• A contractor was given admin "temporarily" and never had it revoked
• Your staging repo has 11 admins because everyone who ever set it up still has access
• An outside collaborator — someone not even in your org — can push to production

None of these show up in any dashboard. You have to go looking. And almost nobody does, because going looking means clicking through dozens of repos, teams, and user profiles one by one.

This is what the security world calls access sprawl — and it's nearly universal in teams that have been on GitHub for more than a year.

What I built

I built gh-iga — an open-source identity governance scanner for GitHub.

One command. 60 seconds. A full picture of who has access to what, and a report you can actually share.

gh-iga scan --org your-org

  gh-iga — Identity Governance Scanner for GitHub
  ─────────────────────────────────────────────────
  Org:      acme-corp
  Members:  84       Teams: 12       Repos: 203

  RISK FINDINGS
  ✗  12 users have admin access to 5+ repos (admin sprawl)
  ✗   8 outside collaborators have write or admin access
  ✗  19 users inactive 90+ days still hold write/admin
  ✗   6 repos have 4+ admins (over-permissioned)
  ⚠   31 users on no team and no direct repo access (orphaned)
  ⚠   14 users with direct repo access could move to teams

  Report written → gh-iga-acme-corp-20260509.html

It also produces a self-contained HTML report you can hand to an auditor, a Markdown report you can paste into a GitHub issue, and JSON output you can pipe into your SIEM or Splunk.

No dashboards to set up. No agent to deploy. Just a token and a command.

What it flags

High severity

• 🔴 Admin sprawl — users with admin on more than N repos (configurable, default 5)
• 🔴 Inactive privileged users — no activity in 90+ days but still holds write or admin
• 🔴 Privileged outside collaborators — externals with write or admin on any repo

Medium severity

• 🟡 Over-permissioned repos — more than N admins on a single repo
• 🟡 Orphaned members — in the org but on no team and no repo

Hygiene

• 🔵 Direct access candidates — users with redundant direct grants already covered by a team

Every threshold is configurable. The defaults are reasonable but your org might want tighter rules.

No org? No problem.

You don't need a GitHub org to use it. If you're a solo developer or working with personal repos:

gh-iga scan-user

This scans all your personal repos, shows every collaborator and their permission level, and flags anything worth reviewing. Good habit before you open-source something or hand off a project.

Getting started

Prerequisites: Python 3.9+, Git

# Clone and install
git clone https://github.com/abhishek20c/gh-iga.git
cd gh-iga
pip install -e .

# Create a token at github.com/settings/tokens
# Scopes needed: repo, read:org (for org scan)

# Run
export GITHUB_TOKEN=ghp_your_token_here
gh-iga scan-user          # personal repos
gh-iga scan --org myorg   # org scan

The tool is read-only by design. It will never modify your org, repos, or permissions. Your token is never written to disk or included in any output.

Run it in CI too

Drop this in your GitHub Actions and get a weekly access review automatically:

name: Weekly access review
on:
  schedule:
    - cron: '0 9 * * 1'  # every Monday 9am
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install gh-iga
      - run: gh-iga scan --org ${{ github.repository_owner }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_IGA_TOKEN }}
      - uses: actions/upload-artifact@v4
        with:
          name: access-report
          path: gh-iga-*.html

Apache 2.0 licensed. The codebase is clean Python — scanner.py handles the GitHub API calls, rules.py is where all the flag logic lives (easy to add new rules), and the reports are Jinja2 templates.

If you find it useful, a ⭐ on GitHub goes a long way for visibility.

What I've learned

Access governance is one of those things that every team knows they should do and almost no team actually does — because the tooling either doesn't exist, costs money, or requires a two-week implementation project.

The goal with gh-iga is to make it something you actually do: one command, runs in 60 seconds, gives you a shareable report. Low enough friction that it becomes a habit.

If you run it and find something surprising in your org — I'd love to hear about it in the comments.

Built with Python, requests, rich, and jinja2. Runs anywhere Python runs.
github.com/abhishek20c/gh-iga