t0-pats-all-repos.json

{
  "name": "GitHub: Tier Zero PATs (All Repositories)",
  "description": "Fine-grained personal access tokens scoped to all repositories in the organization that have at least one write permission. A single compromised token grants write access to every repository. PATs with only read permissions are excluded — they pose a data exfiltration risk but do not grant control over the organization.",
  "cypher": "MATCH (n:GH_PersonalAccessToken {repository_selection:'all'})\nWHERE ANY(permission IN n.repository_permissions WHERE permission ENDS WITH ':write')\nRETURN n",
  "enabled": true,
  "zone": "Tier Zero",
  "allow_disable": true
}