Review Access
Check your GitHub teams and permissions, and act on the access risks Shield detects.
Shield reports on access. It never changes it - make every fix in GitHub.
Teams
Go to Shield → Teams to review your organization's team structure, including nested teams.
Check each team for:
| What to check | Where |
|---|---|
| Who is in the team, and who is a maintainer | Members |
| Which repositories the team can reach, and at what permission level | Repositories |
| The default repository permission the team grants | Team header |
| Whether the team is closed or secret | Team header |
Use this to answer "who can merge to this repository?" without opening GitHub settings team by team.
Risks
Go to Shield → Risks. Shield analyzes your access graph and lists problems with a severity and a recommended fix.
| Risk | What to do |
|---|---|
| Outside collaborator | Remove them, or add them to the organization and grant access through a team. |
| Over-privileged access | Grant the least privilege required - push instead of admin or maintain - preferably through a team. |
| Admin sprawl | Lower the team's default repository permission, and reduce the number of maintainers to the minimum needed. |
| Stale structure | Remove unused or empty teams, grant repository access to teams that have none, and add a second maintainer to any team relying on one. |
Filter by category or severity to work through one class of problem at a time. Fix the issue in GitHub, then reload the page - risks are recomputed on each visit.
Check coverage before trusting an empty list
The page reports how many teams, members, and repositories the analysis actually saw. If the access snapshot has not synced, an empty risk list means "not yet synced", not "all clear".