GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — docs: Security Requirements for org members (2FA, access model, forking policy) by jfathi · Pull Request #20 · hack4impact/.github

Conversation

@jfathi

@jfathi jfathi commented Sep 15, 2026

Copy link
Copy Markdown

What this is

The member-facing security guide promised in Slack — the org-hardening requirements, verified against live org settings on 2026-09-15 before writing:

  • 2FA mandatory (org-enforced) + web-commit sign-off
  • Two-person integrity on main org-wide: PR required, 1 approval, approver must differ from the last pusher, threads resolved, no force-push (the protect-main ruleset)
  • Zero-access defaults: org membership grants no private-repo access; everything flows through teams
  • The access model: National Projects = write on shared public repos, read on most private ones; special/NDA projects stay behind restricted teams; chapter repos write-scoped to their own sub-teams
  • Projects/scrum boards scoped the same way (team-visible, one public board)
  • Private-repo forking disabled; repo delete/transfer admin-only (the archival-policy ruleset)
  • How to request access, for members and leads

docs/SECURITY.md gains a one-line pointer at the top and stays the researcher-facing disclosure policy — the two documents now have distinct audiences.

No secret team names, no member names, no repo enumeration — publish-safe by construction.

🤖 Generated with Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@jfathi @claude
docs: security requirements for org members — 2FA, access model, fork…
1f77ffa 
…ing policy

Member-facing guide to the org hardening: mandatory 2FA, two-person
integrity on main (PR + independent approval), zero-access defaults,
team-scoped access (Nationals = write on shared public repos, read on
most private; special/NDA projects excluded), board scoping, private-repo
fork ban, and the repo lifecycle rules. Cross-linked from SECURITY.md,
which remains the researcher-facing disclosure policy.

Co-Authored-By: Claude Fable 5 <[email protected]>
@jfathi

jfathi commented Sep 16, 2026

Copy link
Copy Markdown
Author

@khoa-l - please review this PR as a first pass for on-repo guidelines for the national org.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
khoa-l
khoa-l requested changes Sep 18, 2026
View reviewed changes

@khoa-l khoa-l left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Couple small changes, but looks good

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread docs/SECURITY_REQUIREMENTS.md

- Your GitHub account must have **two-factor authentication enabled**. GitHub enforces this at the org level: you can't join, and can't remain, without it. Use an authenticator app or passkey rather than SMS if you can.
- Edits made through the GitHub web editor require a **sign-off** (GitHub adds it when you tick the box on the commit form). If a web commit is rejected, that's why.
- Use your own account only. Never share credentials or tokens, and never commit secrets (API keys, passwords, partner data) to any repo, public or private.

@khoa-l khoa-l Sep 18, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add info about getting access to and using the Vaultwarden resource here. Or at least mention that it's an approved resource for this.

Although we will probably need a similar how to use the Vaultwarden document for the leadership in chare of that.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread docs/SECURITY_REQUIREMENTS.md

---

Questions about any of this? Ask your chapter lead first, or open a thread in the org Slack.

@khoa-l khoa-l Sep 18, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we point them to a channel? We have #hack-overflow or just have them post in #general?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@khoa-l khoa-l khoa-l requested changes

Requested changes must be addressed to merge this pull request.

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@jfathi @khoa-l
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.