Contributed by Travis McDadeAll contributors →
Part of CIS · GitHub · Organization settings · All checks
```powershell title="Run this check" Invoke-Maester -TestId CIS.GH.1.2.2 ``` ## Overview Organization members cannot create public or private repositories. Limiting repository creation makes ownership and access easier to review and reduces the risk of code or data being exposed through an unmanaged repository. Members who need a new repository may need an owner, administrator, or approved internal process to create it. CIS GitHub Benchmark v1.2.0 lists section 1.2.2 as a Manual assessment. This test checks the connected organization's repository-creation settings from `GET /orgs/{org}`; it does not replace the rest of the manual review. The test passes when `members_can_create_public_repositories` and `members_can_create_private_repositories` are both Boolean `false`. Either value being Boolean `true` is enough to fail, even if the other value is missing or invalid. Otherwise, a missing, null, or non-Boolean value produces **Skipped**, with a reason explaining what could not be checked. Request or JSON parsing failures produce **Error**. The report also shows `members_can_create_internal_repositories` and the legacy `members_allowed_repository_creation_type` when GitHub returns them. Neither decides the result: the CIS audit covers public and private repository creation, and Maester uses the separate settings for those repository types. The test covers the connected organization's returned settings. It does not scan other organizations or reconstruct inherited policies. Maester checks these fields after parsing the response, rather than validating the entire response schema. Missing data does not mean a setting is disabled or the recommendation does not apply. #### Permissions required Use an organization owner with a classic PAT or OAuth token carrying `admin:org` to read the full organization settings. With fine-grained PATs, the connection's membership check uses organization **Members: read**, and its separate administration check uses **Administration: read**. A successful connection does not guarantee that GitHub returns the fields this test needs. See [Connect-MtGitHub](https://maester.dev/docs/commands/Connect-MtGitHub) for the connection checks. For GHE.com, use `https://api.SUBDOMAIN.ghe.com` and a token for that host; do not assume the github.com device flow applies. The same missing-data rules apply to GHEC, Enterprise Managed Users, and GHE.com. #### Remediation action 1. On the connected GitHub web host (`github.com` or your enterprise's `SUBDOMAIN.ghe.com`), open **Your organizations**, select the organization, then go to **Settings** > **Access** > **Member privileges**. 2. Clear the public and private repository-creation options for members and save the changes. If an enterprise policy controls the options, ask an enterprise owner to make the change. 3. Review internal repository creation separately; it does not decide this check. #### Related links * [CIS GitHub Benchmark v1.2.0 - Section 1.2.2](https://www.cisecurity.org/benchmark/github) * [GitHub: Restricting repository creation](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-organization-settings/restricting-repository-creation-in-your-organization) * [GitHub REST API: Get an organization](https://docs.github.com/en/enterprise-cloud@latest/rest/orgs/orgs?apiVersion=2026-03-10#get-an-organization) ## Details