Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/morwn/github-threat-detector/llms.txt

Use this file to discover all available pages before exploring further.

GitHub Threat Detector ships 17 heuristic analyzers that collectively cover the most common supply chain attack patterns seen in open-source repositories. Each rule is assigned a severity level — critical, high, or medium — and operates against one or more data sources collected by the collect command. Understanding which rules require which flags helps you make deliberate trade-offs between scan coverage and collection time.

​
All Rules

Rule IDCategorySeverityRequired Data
workflow-file-changeCI/CD AttackshighEvents only
pr-target-abuseCI/CD AttackscriticalEvents only
workflow-run-from-forkCI/CD AttackscriticalWorkflow runs (--actions)
release-actor-anomalyRelease TamperingcriticalEvents + releases (--releases) + contributors (--contributors, optional)
rapid-releasesRelease TamperinghighReleases (--releases)
force-push-defaultPush AnomalieshighEvents only
rapid-sequential-pushesPush AnomaliesmediumEvents only
delete-branch-protectionPush AnomalieshighEvents only
fork-spikePush AnomaliesmediumEvents only
new-actor-ci-changeSocial EngineeringhighEvents only
member-added-suspiciousSocial EngineeringmediumEvents only
repo-made-publicSocial EngineeringhighEvents only
commit-date-gapCommit TamperingcriticalCommits (--commits)
null-committer-emailCommit TamperingcriticalCommits (--commits)
issue-prompt-injectionAI Workflow AbusecriticalEvents + contributors (--contributors)
issue-rapid-closeAI Workflow AbusehighEvents only
ai-workflow-unsafe-inputAI Workflow AbusecriticalWorkflow files (--workflow-files)

​
Severity Breakdown

Critical

7 rules — Findings at this level indicate a high-confidence indicator of compromise or active exploitation. Treat every critical finding as requiring immediate human review.Rules: pr-target-abuse, workflow-run-from-fork, release-actor-anomaly, commit-date-gap, null-committer-email, issue-prompt-injection, ai-workflow-unsafe-input

High

7 rules — Findings are strong signals worth prompt investigation. Some may have legitimate explanations (e.g. an intentional force push), but each warrants a short audit.Rules: workflow-file-change, rapid-releases, force-push-default, delete-branch-protection, new-actor-ci-change, repo-made-public, issue-rapid-close

Medium

3 rules — Findings provide useful context and may indicate automation or misconfigurations. Review in batch during regular security audits.Rules: rapid-sequential-pushes, member-added-suspicious, fork-spike

​
Data Collection Requirements

Different detectors require different data sources. Passing extra flags to collect increases coverage at the cost of additional GitHub API calls.
FlagData CollectedUnlocks Rules
(none)Public GitHub events (past 90 days)workflow-file-change, pr-target-abuse, force-push-default, rapid-sequential-pushes, delete-branch-protection, fork-spike, new-actor-ci-change, member-added-suspicious, repo-made-public, issue-rapid-close
--actionsWorkflow run records from the Actions APIworkflow-run-from-fork
--releasesFull release history via the Releases APIrelease-actor-anomaly, rapid-releases
--contributorsContributor list from the Repository APIImproves accuracy of release-actor-anomaly; required for issue-prompt-injection
--commitsPer-commit metadata (author/committer dates and emails)commit-date-gap, null-committer-email
--workflow-filesRaw YAML content of .github/workflows/ filesai-workflow-unsafe-input
To run a complete scan using all data sources, collect with every flag enabled: 
github-threat-detector collect \
  --repo owner/repo \
  --actions \
  --releases \
  --contributors \
  --commits \
  --workflow-files
Then run the analyzer: 
github-threat-detector analyze --repo owner/repo
Omit any flag you don’t need to reduce API quota usage. The rules that depend on those data sources will simply not produce findings for that run.

Build docs developers (and LLMs) love

Get started for freeTalk to us