GitHub Threat Detector is a security monitoring CLI that watches your GitHub repositories for signs of supply chain attacks, CI/CD abuse, unauthorized releases, and account compromise. It polls the GitHub Events API, stores raw events in PostgreSQL, then runs a battery of heuristic rules — from detectingDocumentation Index
Fetch the complete documentation index at: https://mintlify.com/morwn/github-threat-detector/llms.txt
Use this file to discover all available pages before exploring further.
pull_request_target privilege escalation to identifying AI workflow prompt injection — and surfaces prioritized findings with severity levels ranging from low to critical.
Quickstart
Set up your environment and run your first threat scan in under 5 minutes.
Configuration
Configure repositories, tokens, database connection, and detection thresholds.
CLI Reference
Full reference for the
collect, analyze, report, and init-db commands.Threat Detection
Browse all 15 detection rules across CI/CD, releases, commits, and social engineering.
Architecture
Understand the data model, collectors, and analyzer pipeline.
Trivy Breach Case Study
A phased timeline of the aquasecurity/trivy supply chain attack, reconstructed from event logs.
How It Works
GitHub Threat Detector follows a three-phase pipeline:Collect
Run
python cli.py collect --repos owner/repo to fetch GitHub Events API data for your repositories into Postgres. Optionally pull workflow runs, releases, contributor lists, workflow YAML files, and commit metadata.Analyze
Run
python cli.py analyze to execute all 15 detection rules against the collected data. Each rule queries Postgres and emits findings with a severity, description, and JSON evidence blob.Detection Coverage
GitHub Threat Detector covers five attack categories:CI/CD Attacks
pull_request_target abuse, workflow file injection by unknown actors, fork-triggered workflow runs.Release Tampering
Releases by actors with no push history, rapid automated release bursts.
Push Anomalies
Force pushes to default branches, rapid sequential pushes, deletion of protected branches.
Social Engineering
First-time contributors touching workflows, suspicious collaborator additions, repos made public.
Commit Tampering
Author/committer date gaps indicating rebase injection, null committer email attacker fingerprints.
AI Workflow Abuse
Prompt injection via issue titles, rapid issue open/close probing, unsafe user input into AI tools.
GitHub Threat Detector requires a PostgreSQL database and a GitHub personal access token. See the Quickstart for setup instructions.