Agent Wranglers

Required

Protect the accounts that can change the code

Require two-factor login for everyone with write access to the code host. Remove a person's access when they leave, on the same day as their other keys.

By Agent Wranglers. Updated .

Risk if broken

An account or system taken over

How to do it

Require two-factor login in the organisation settings, and allow only secure methods, such as passkeys, security keys or authenticator apps. Choose them as two-factor login describes. Give each person their own account, with write access only to the repositories they work on. Give bots their own app or token with the fewest rights. Remove leavers by the deadline in Remove access within a day of leaving.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

# GitHub: members without two-factor login, or with only SMS (needs an owner token)
for filter in 2fa_disabled 2fa_insecure; do
  gh api "orgs/example/members?filter=$filter" --jq '.[].login'
done | grep . && { echo "FAIL: members without secure two-factor login"; exit 1; } || echo "PASS"

How to check

The organisation's member list, filtered for missing or insecure two-factor login, is empty. Every member and outside collaborator matches a name on the current staff or contractor list.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts">Agent Wranglers engineering playbook</a>. In code you write, add a comment next to it with the same link.