Repository Visibility Distribution

Overview

The Repository Visibility Distribution widget provides a visualization of repositories across GitHub, Bitbucket, and Azure DevOps platforms, categorized by their visibility settings (public vs private).

Security Value

Understanding repository visibility is critical for security posture management as it helps identify potential exposure of sensitive code and intellectual property.

• Public repositories are accessible to anyone on the internet and can pose security risks if they contain sensitive information, credentials, or proprietary code

• Private repositories restrict access to authorized users only, providing an additional layer of security for sensitive codebases

Interpretation

• A high percentage of public repositories may indicate increased attack surface and potential for sensitive data exposure

• Changes in the distribution over time can signal drift in security practices

• Organizations often aim for a visibility distribution that aligns with their security policies (e.g., "public by exception")

Recommended Actions

1. Review public repositories to ensure they don't contain sensitive information

2. Implement repository visibility governance controls

3. Establish clear guidelines for when repositories can be made public

4. Regularly audit repository visibility settings against organizational policies

5. Consider implementing branch protection rules for all repositories, especially public ones