Skip to content
Code To Cloud

GitHub Well-Architected Health Check

Is your GitHub organization secure, and is it set up the right way?

Your code, pipelines and cloud deployments all run through GitHub, and now AI agents do too. We check who can get in and what can reach production, and review the organization against GitHub's own Well-Architected framework.

Book a Discovery CallTake the free self-check

Last updated:

Is it for you?

Who it's for, and who it isn't.

A good fit

  • Your code and deployments run through GitHub, and the organization has grown without a review.
  • You're rolling out GitHub Copilot or its coding agent and want the guardrails right first.
  • Your pipelines deploy to Azure and you want to know what a compromised workflow could reach.

Probably not yet

  • You need a compliance audit or certification. This is an engineering assessment.
  • Your code isn't on GitHub.

Free self-check · 8 questions · no email

Score yourself in two minutes.

Answer for your own environment. You'll get a security score, a best-practice score and your gaps, each linked to the public framework it comes from.

Part 1 · Is it secure?

1. Are single sign-on and two-factor authentication enforced for everyone in the organization?

2. Is secret scanning with push protection turned on for your repositories?

3. Do workflows use least-privilege token permissions and pin third-party actions to a full commit SHA?

4. Do deployments to Azure use OIDC instead of cloud secrets stored in GitHub?

Part 2 · Is it set up the right way?

5. Do the branches that ship require a reviewed pull request and passing checks?

6. Are Dependabot alerts and code scanning findings triaged on a schedule?

7. Are Copilot and coding agent policies set at the organization level, not left to each repository?

8. Is repository access granted through teams rather than to individuals one by one?

0 of 8 answered

Part 1 · Security

Is it secure?

  • Organization and access

    Single sign-on and two-factor enforcement, owners and outside collaborators, personal access tokens and installed GitHub Apps.

  • Secrets and code scanning

    Secret scanning and push protection, code scanning and Dependabot: switched on, and acted on.

  • GitHub Actions

    Workflow permissions, pinned third-party actions, OIDC to Azure instead of stored secrets, and self-hosted runners.

Part 2 · Best practice

Is it set up the right way?

  • Repository governance

    Rulesets and branch protection, required reviews and status checks on the branches that ship, and how repositories and teams are organized.

  • Copilot and agents

    Copilot policies, and what the coding agent and MCP servers are allowed to do in your repositories.

  • GitHub Well-Architected

    How the organization measures up on GitHub Well-Architected's five pillars: productivity, collaboration, application security, governance and architecture.

Measured against

Public frameworks, not our opinion.

What you get

Findings you can act on.

  • Written findings for security and for best practice, with the evidence behind each one.
  • A prioritized list of what to fix first, in the order to do it.
  • A working session where we walk your team through the findings.

How it runs

From first call to findings.

  1. 01

    Discovery call

    Thirty minutes on what you run and what's worrying you.

  2. 02

    Scope agreed in writing

    We confirm what's in and out, and the fixed fee, before any work starts.

  3. 03

    Assessment

    We review security and best practice against the frameworks on this page.

  4. 04

    Readout and next step

    We walk through the findings. Fixing them with us is your choice.

FAQ

Questions about the GitHub Well-Architected Health Check.

What is a GitHub Well-Architected Health Check?

A fixed-fee check of your GitHub organization. On security, it covers access and tokens, secret and code scanning, and GitHub Actions hardening. On best practice, it covers repository governance, the policies for Copilot and its coding agent, and GitHub Well-Architected's five pillars.

Do we need GitHub's paid security features?

No. We check what you have. Some features, such as secret scanning on private repositories, need a paid GitHub plan, and we tell you which findings depend on one so you can decide whether it's worth it.

Is this the same as a security audit?

People often call it one. It is a security review of how your environment is configured and built, measured against the public frameworks named on this page. It is not a compliance audit or certification and makes no compliance, certification or data residency finding, though the findings can feed one.

Where do you work?

We're in the Calgary area and work with clients across Canada and the United States. The assessment is delivered remotely, on Mountain Time.

How much does it cost?

The GitHub Well-Architected Health Check is a fixed fee, scoped on a discovery call and agreed in writing before work starts. The fee depends on the size of what's in scope.

What access do you need?

We agree the access in the written scope. We ask for read-only access wherever it's enough, and time with the people who run the environment.

Who does the work?

Each engagement has its own lead from our team of employees and specialist contractors in cloud, AI and software engineering, with the team sized to the work. Leads make the day-to-day decisions, so nothing waits on one person. Kevin Evans, the founder and a Microsoft MVP for Azure, sets the technical standards we all build to. Everything is built in your own tenant and repositories, so your team owns and extends it.

What happens after the assessment?

You decide. Some teams fix the findings themselves. Some ask us to fix them with their team, as a project. Either is a normal outcome.

Also available

Other security assessments.

Ready to find out?

Book a discovery call. We'll scope the GitHub Well-Architected Health Check with you, or tell you if you don't need it yet.

Book a Discovery CallSee all services