> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The Big Question

> Advice on GitHub Enterprise security posture and governance to prevent compromised credentials, stale accounts, leaked secrets, and runaway CI costs, highlighting admin controls and best practices.

Before we touch a single GitHub setting or write a single YAML file, we must first address enterprise security posture at scale.

![A presentation slide titled "Before We Begin" showing three option boxes: "Settings" with a GitHub icon, "YAML" with a document icon, and a highlighted "Enterprise security posture" box with a shield and check mark. The slide also shows a small © Copyright KodeKloud in the corner.](https://mintcdn.com/kodekloud-c4ac6d9a/s_90rjuRPpIstUzn/images/GitHub-Administration-Certification/Course-Introduction/The-Big-Question/before-we-begin-enterprise-security-posture.jpg?fit=max\&auto=format\&n=s_90rjuRPpIstUzn\&q=85\&s=6a79293787e7a749c67cc943b842becb)

Start with a simple, uncomfortable question — the one that defines the GitHub administrator role:

What happens when thousands of engineers push code every day and there is no centralized governance enforcing the gates?

The answer is visible in the threat landscape: 83% of data breaches begin with compromised credentials, and such incidents cost organizations an average of nearly \$5 million. With more than 100 million developers worldwide, GitHub sits at the center of software delivery — and therefore at the center of supply chain attack risk.

![An infographic titled "Today's Threat Landscape" showing an unlocked ID card with "83%", a building with "\$5M", and "100M+" alongside user icons and the GitHub logo. It summarizes security risk statistics and potential financial impact.](https://mintcdn.com/kodekloud-c4ac6d9a/s_90rjuRPpIstUzn/images/GitHub-Administration-Certification/Course-Introduction/The-Big-Question/todays-threat-landscape-security-stats.jpg?fit=max\&auto=format\&n=s_90rjuRPpIstUzn\&q=85\&s=dad983b767be11d221255422df7f3775)

At scale, every under-reviewed commit is a potential breach, and every departing employee can be an entry point. If your organization runs on GitHub Enterprise and nobody knows how to administer it at scale, you aren't just running infrastructure — you're managing corporate liability.

To make this concrete, consider a few common failure modes that happen when users, automation, and tokens spin out of control without oversight.

![A slide titled "When Nobody Is Watching" showing a magnifying glass highlighting a warning icon, with blue tiles around it labeled "Access tokens", "Users", and "Automation." The slide has a small "© Copyright KodeKloud" note in the corner.](https://mintcdn.com/kodekloud-c4ac6d9a/s_90rjuRPpIstUzn/images/GitHub-Administration-Certification/Course-Introduction/The-Big-Question/when-nobody-is-watching-magnifying-warning.jpg?fit=max\&auto=format\&n=s_90rjuRPpIstUzn\&q=85\&s=d8d70c3b09bc21df347e0f44f22dc334)

1. Stale user accounts and long-lived tokens
   A developer leaves in January, but their account and API tokens remain active through September because deprovisioning isn't automated. Their personal access tokens (PATs) were created with no expiry and are still used in a legacy CI pipeline. That creates a nine-month window for an attacker to access repositories, inject malware, or exfiltrate data.

![A slide titled "Scenario 1 – The Ghost Account" with a timeline from Jan to Sep showing a developer leaving and a problem discovered nine months later. It highlights three issues: a ghost account still has write access, old personal access tokens (PATs) are set to never expire, and legacy CI pipeline tokens remain valid.](https://mintcdn.com/kodekloud-c4ac6d9a/s_90rjuRPpIstUzn/images/GitHub-Administration-Certification/Course-Introduction/The-Big-Question/ghost-account-stale-pats-ci-tokens.jpg?fit=max\&auto=format\&n=s_90rjuRPpIstUzn\&q=85\&s=5ced1cfde43b3d1430010ee5444e9030)

2. Accidental secret commits
   A simple mistake — committing cloud credentials — can turn into a weekend incident. Example:

```bash theme={null}
$ cat creds.json
{
  "AWS_ACCESS_KEY_ID": "AKIA2E51V7EXAMPLE",
  "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
}
$ git add creds.json
$ git commit -m "quick fix"
[main 1a2b3c4] quick fix
 1 file changed, 1 insertion(+)
$ git push origin main
```

Automated scanners can discover such hard-coded secrets in minutes. From there, attackers can spin up cloud workloads, run crypto-mining, or extract sensitive data — and the cloud bill and incident response costs can spike rapidly.

3. Runaway CI/CD costs and unchecked runners
   Unrestricted use of inexpensive or expensive runners (for example, macOS runners) across thousands of PRs and CI jobs can produce enormous bills. If teams run macOS runners on every comment or PR without governance, GitHub Actions usage can explode and result in large overage charges that impact the finance organization.

![A presentation slide titled "Scenario 3 – Runaway CI Costs" showing two dark buttons labeled "CI Runners" and "Cost Management," an upward-trending bar chart labeled "Actions Usage / macOS runners – every commit," and a callout that says "The CFO calls."](https://mintcdn.com/kodekloud-c4ac6d9a/s_90rjuRPpIstUzn/images/GitHub-Administration-Certification/Course-Introduction/The-Big-Question/runaway-ci-costs-cfo-calls.jpg?fit=max\&auto=format\&n=s_90rjuRPpIstUzn\&q=85\&s=8e79a856eec4e3a7a9533aa9d7a9a76f)

Quick summary — why these problems matter

| Risk | Typical cause | Impact |
| - | - | - |
| Ghost accounts & lingering tokens | No automated deprovisioning, never-expiring PATs | Long windows for compromise and data exposure |
| Committed secrets | Lack of pre-push secret scanning or push protection | Cloud compromise, unexpected costs, reputational damage |
| Runaway CI costs | No runner governance, unrestricted GitHub Actions usage | Large overage bills and lost budget control |

A useful mental model: treat GitHub Enterprise like a major airport. Thousands of people and automated processes move through it daily. The GitHub Enterprise administrator is simultaneously the air traffic controller, the security checkpoint, and the operations manager. Without RBAC and least-privilege, SAML single sign-on and automated deprovisioning, secret scanning and push protection, and policy enforcement for CI/CD runners, processes will collide and incidents will follow.

That is exactly why the GitHub Enterprise Administrator role exists — to bring order, reduce attack surface, and limit corporate liability.

Key priorities for GitHub Enterprise administrators: implement RBAC and least privilege, enable SAML/SSO with automated deprovisioning, enforce token lifecycle policies (no never-expiring `PATs` — see [https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)), enable secret scanning and push protection, and govern CI/CD runner usage and costs.

Further reading and resources

* GitHub SAML SSO: [https://docs.github.com/en/authentication/connecting-to-github-with-saml-single-sign-on](https://docs.github.com/en/authentication/connecting-to-github-with-saml-single-sign-on)
* Personal access tokens (PATs): [https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
* Secret scanning: [https://docs.github.com/en/code-security/secret-scanning](https://docs.github.com/en/code-security/secret-scanning)
* GitHub Actions runners: [https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners)

> **[Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/6f6426ae-688c-4b0a-9df6-9d236b28f801/lesson/649e7831-6a27-49e4-a59b-564a8be966b4)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.