Security playbook · AI Employee: Sig

GitHub Outside-Collaborator Review

Zero forgotten outside collaborators

Install this playbookBack to marketplace
The problem

GitHub outside collaborators accumulate. Every consultant, contractor, vendor engineer, and open-source contributor invited to a private repo becomes an outside collaborator; each keeps access indefinitely unless someone removes them. Over 3 years, that's 200 outside collaborators, half of whom haven't touched the repo since 2024. Some work at competitors now. All can clone code, some can push, a few are org admins because someone got tired of managing individual permissions.

At a glance
Trigger
Cron (weekly)
Approvals
Owner attests per repo
What it does
Writes to your systems
Systems
GitHub
How it feels in production

An hour-by-hour walkthrough.

Every Monday, Sig scans every private GitHub repo across the org for outside collaborators. For each, it computes: - Last activity (commit, comment, review) on the repo - Current employment (LinkedIn signal — still where they were when invited) - Permission level (read, triage, write, maintain, admin) - Business context: still on an engagement, or has the project ended Sig builds the monthly review packet per repo owner: - Collaborators active in last 90 days: keep - Collaborators no activity 90-180 days + still at inviting company: propose downgrade to read or remove - Collaborators no activity 180+ days: propose remove - Collaborators now at competitor / changed employer: propose immediate remove (with justification) - Collaborators with admin permission but not needing it: propose downgrade Repo owner reviews. One-click approve or override. Sig executes: removes, downgrades, or logs the retain-with-reason. Weekly digest to CISO: outside-collaborator count trend, admin-level count, top repos by external access, cross-competitor exposure.
How it works

Step by step.

  1. 01

    Scan every repo for outside collaborators

    GitHub org + repo permissions API. Enumerate outside collaborators + permissions across every private repo.

    GitHub · GitLab · Bitbucket
  2. 02

    Enrich with activity + current employment

    Repo activity per collaborator (commits, comments, reviews). LinkedIn signal for current employment.

    GitHub audit · LinkedIn Sales Navigator
  3. 03

    Recommend keep / downgrade / remove

    Rule-based recommendations with activity + employment + permission-level thresholds. Justifications inline.

    Recommendation engine · Policy config
  4. 04

    Repo owner review + one-click execute

    Batch review by repo owner. Approve executes removals + downgrades. Overrides logged with reason.

    Web UI · Slack · Approval flow
  5. 05

    Digest + audit trail

    Weekly digest with trend + top exposures. Full audit trail for compliance evidence.

    Analytics · Slack digest · Audit log
Systems and wiring

What you connect to make this run.

GitHub · GitLab · Bitbucket

read+write

Repo permissions read; collaborator removal / downgrade write via API.

LinkedIn Sales Navigator

read

Current employment for outside collaborators. Job-change signal drives immediate-remove recommendation.

Vendor / contractor registry

read

Active-engagement status for known contractors. Ended engagement = expected remove.

Slack · Teams

read+write

Owner review interface. Batch approvals reduce owner burden.

What changes

Before and after, honestly.

Stale outside collaborators (180+ days inactive)
Before
40-70% of external base
After
Under 5%
Ex-employer outside collaborators still with access
Before
10-25%
After
Under 1%
Time to complete quarterly external-access review
Before
3-6 weeks
After
2-4 business days
Audit findings on external access
Before
3-15 per audit
After
Zero
Related

Playbooks that pair with this one.

Security

User Access Reviews (UAR)

Same review pattern for internal application access.

Security

Cloud IAM Reviews

Cloud IAM has its own review cadence with the same mechanism.

IT

Contractor Access Expiration

Contractor engagement end triggers GitHub removal upstream.

Frequently asked

Answers about this playbook.

What about outside collaborators for open-source projects (public contribution model)?

Public repos exempt; this playbook scans private repos. Open-source contribution to public projects doesn't need this review.

How does it handle enterprise-team members vs. outside collaborators?

Different objects in GitHub. Enterprise members follow employee-access lifecycle; outside collaborators are the specific scope here.

What if a contractor is between engagements and might return?

Repo owner can retain with reason "active engagement pending 2026-Q4." Retention with expected-restart date; re-review at that date.

Can it handle ownership changes (repo transferred to different owner)?

New owner picks up the review responsibility. History preserved; prior owner's decisions visible for continuity.

How does it interact with GitHub's own audit + security features?

Complementary. GitHub Advanced Security shows current state; Sig adds the review + remediation workflow + trend + external-employment signal that GitHub lacks.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks