Summary
| Forestall ACL Alias | GH_APP_ACCESS |
| Edge Type | Relationship |
| Affected Object Types | GitHub Repositories |
| Exploitation Certainty | N/A (structural) |
| GitHub Role / Permission | GitHub App installation repository access |
Description
GH_APP_ACCESS is a structural relationship recording that a GitHub App installation has access to a repository:
(GHAppInstallation)-[GH_APP_ACCESS]->(GHRepository)It is created for installations with repository_selection = "selected", linking the app to each specific repository it was granted. (Installations with repository_selection = "all" implicitly reach every org repository; that breadth is captured at the organization level rather than as one edge per repo.)
This edge is the app equivalent of GH_COLLABORATOR (user → repo) and GH_HAS_ACCESS (team → repo): it shows which repositories an app can touch. It is part of the attack surface — compromising the app (its private key or an installation token) yields access to these repositories — but it is structural; the dangerous, admin-level reach is modelled by GH_ADMIN (app → org).
Identification
GitHub Web Interface
Open the organization → Settings → GitHub Apps → an installation → Repository access shows the selected repositories.
GitHub CLI
# repositories accessible to an installation (requires the app's installation token)gh api "/installation/repositories" --jq '.repositories[].full_name'Exploitation
Not applicable on its own — GH_APP_ACCESS is structural. The repositories reachable through it become exploitable if the app’s credentials are compromised; the impact depends on the app’s permission set (read vs write vs admin — see GH_ADMIN).
Mitigation
- Scope app repository access narrowly — prefer “only select repositories” over “all repositories”.
- Grant least permission to the app, so even reachable repos expose minimal capability.
- Protect app credentials (private key, installation tokens) and review installations regularly.
Detection
| Event | Description |
|---|---|
integration_installation.repositories_added |
An installation gained access to repositories |
integration_installation.repositories_removed |
Repositories were removed from an installation |
Alert on installations gaining access to sensitive repositories.