openhound-github 0.16.1__tar.gz → 0.17.0__tar.gz

{openhound_github-0.16.1 → openhound_github-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.16.1
+Version: 0.17.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -84,6 +84,49 @@ The collector runs successfully with the documented read-only permission set. So
 
 If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
 
+### Classic personal access token inventory
+
+With GitHub Enterprise Cloud credentials, the collector uses the enterprise
+credential inventory export to collect classic personal access tokens. It
+requests the full inventory, stores every CSV row and its original field values
+in the `enterprise_credential_inventory` resource, and currently models only
+classic PAT rows. The export contains credential metadata, including owners,
+scopes, authorization details, and token hashes used for audit correlation. It
+does not contain plaintext PAT values. Limit access to the raw output to people
+who need the credential inventory.
+
+The enterprise GitHub App needs **Enterprise credentials: read** permission.
+When collecting with a classic PAT instead of an app installation, that token
+needs the `read:enterprise` scope. If an enterprise app also has
+`credentials.pat_token` configured, the app remains the primary export
+credential. The collector retries once with the PAT only when GitHub rejects
+the app's export creation for authorization. It does not switch credentials
+after an export starts or when GitHub reports a rate limit.
+
+Rate-limit retry warnings identify the affected method and API path.
+
+The CSV download is streamed, but the parsed export is held in memory as one
+raw record; very large enterprises may need a chunked raw-resource design.
+
+GitHub limits the number of exports an enterprise can start per day. When the
+last successful export was downloaded within the past 24 hours, the collector
+downloads it again before trying to start a new export. If GitHub reports that
+the saved export is gone, the collector starts a new one and polls until its
+CSV is ready. GitHub may still reject a new export when its limit is reached.
+The raw record's `as_of` value and each PAT node's `inventory_as_of` value
+show when that snapshot was taken. An unavailable or denied export is logged
+and does not stop other resources from collecting.
+
+Classic PAT nodes include the owner, scopes, lifecycle dates, credential
+state, direct enterprise authorization, and total authorization count.
+Organization edges record authorizations reported in the export. The
+export does not enumerate repositories accessible to a classic PAT, so this
+collection does not emit classic PAT-to-repository access edges. Potential
+repository access can be derived from the token owner's repository roles and
+the token's scopes, subject to organization policy and SSO authorization; it
+is not a direct grant reported by the export. GitHub Enterprise Server and
+organization-only configurations skip this resource.
+
 [![Python Version](https://img.shields.io/badge/Python-3.13-brightgreen.svg)](#about)
 
 ## Getting Started

{openhound_github-0.16.1 → openhound_github-0.17.0}/README.md

@@ -73,6 +73,49 @@ The collector runs successfully with the documented read-only permission set. So
 
 If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
 
+### Classic personal access token inventory
+
+With GitHub Enterprise Cloud credentials, the collector uses the enterprise
+credential inventory export to collect classic personal access tokens. It
+requests the full inventory, stores every CSV row and its original field values
+in the `enterprise_credential_inventory` resource, and currently models only
+classic PAT rows. The export contains credential metadata, including owners,
+scopes, authorization details, and token hashes used for audit correlation. It
+does not contain plaintext PAT values. Limit access to the raw output to people
+who need the credential inventory.
+
+The enterprise GitHub App needs **Enterprise credentials: read** permission.
+When collecting with a classic PAT instead of an app installation, that token
+needs the `read:enterprise` scope. If an enterprise app also has
+`credentials.pat_token` configured, the app remains the primary export
+credential. The collector retries once with the PAT only when GitHub rejects
+the app's export creation for authorization. It does not switch credentials
+after an export starts or when GitHub reports a rate limit.
+
+Rate-limit retry warnings identify the affected method and API path.
+
+The CSV download is streamed, but the parsed export is held in memory as one
+raw record; very large enterprises may need a chunked raw-resource design.
+
+GitHub limits the number of exports an enterprise can start per day. When the
+last successful export was downloaded within the past 24 hours, the collector
+downloads it again before trying to start a new export. If GitHub reports that
+the saved export is gone, the collector starts a new one and polls until its
+CSV is ready. GitHub may still reject a new export when its limit is reached.
+The raw record's `as_of` value and each PAT node's `inventory_as_of` value
+show when that snapshot was taken. An unavailable or denied export is logged
+and does not stop other resources from collecting.
+
+Classic PAT nodes include the owner, scopes, lifecycle dates, credential
+state, direct enterprise authorization, and total authorization count.
+Organization edges record authorizations reported in the export. The
+export does not enumerate repositories accessible to a classic PAT, so this
+collection does not emit classic PAT-to-repository access edges. Potential
+repository access can be derived from the token owner's repository roles and
+the token's scopes, subject to organization policy and SSO authorization; it
+is not a direct grant reported by the export. GitHub Enterprise Server and
+organization-only configurations skip this resource.
+
 [![Python Version](https://img.shields.io/badge/Python-3.13-brightgreen.svg)](#about)
 
 ## Getting Started

openhound_github-0.17.0/descriptions/edges/GH_AuthorizedForOrganization.md

@@ -0,0 +1,20 @@
+# GH_AuthorizedForOrganization
+
+## General Information
+
+Classic personal access token has a recorded authorization for this organization.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_ClassicPersonalAccessToken` | `GH_Organization` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_ClassicPersonalAccessToken"]
+    n1["GH_Organization"]
+    n0 -.->|GH_AuthorizedForOrganization| n1
+```

openhound_github-0.17.0/descriptions/edges/GH_Contains.md

@@ -0,0 +1,104 @@
+# GH_Contains
+
+## General Information
+
+The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The enterprise contains enterprise teams, roles, managed users, classic personal access tokens, runner groups, and enterprise runners through their groups. The organization serves as a top-level container for users, teams, repositories, roles, secrets, app installations, fine-grained personal access tokens, and organization runner groups. Native organization runner groups contain organization runners. Repositories contain branches, workflows, branch protection rules, environments, repo-level secrets and variables, and repository-scoped runners. Environments contain environment branch policies, environment-scoped secrets, and environment-scoped variables. This edge is created by the collector to establish the resource hierarchy and is not traversable because containment alone does not imply privilege escalation.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_Enterprise` | `GH_ClassicPersonalAccessToken` | `false` |
+| `GH_Enterprise` | `GH_EnterpriseRole` | `false` |
+| `GH_Enterprise` | `GH_EnterpriseRunnerGroup` | `false` |
+| `GH_Enterprise` | `GH_EnterpriseTeam` | `false` |
+| `GH_Enterprise` | `GH_Organization` | `false` |
+| `GH_EnterpriseRunnerGroup` | `GH_EnterpriseRunner` | `false` |
+| `GH_Environment` | `GH_EnvironmentBranchPolicy` | `false` |
+| `GH_Environment` | `GH_EnvironmentSecret` | `false` |
+| `GH_Environment` | `GH_EnvironmentVariable` | `false` |
+| `GH_OrgRunnerGroup` | `GH_OrgRunner` | `false` |
+| `GH_Organization` | `GH_AppInstallation` | `false` |
+| `GH_Organization` | `GH_OrgRole` | `false` |
+| `GH_Organization` | `GH_OrgRunnerGroup` | `false` |
+| `GH_Organization` | `GH_OrgSecret` | `false` |
+| `GH_Organization` | `GH_OrgVariable` | `false` |
+| `GH_Organization` | `GH_PersonalAccessToken` | `false` |
+| `GH_Organization` | `GH_PersonalAccessTokenRequest` | `false` |
+| `GH_Organization` | `GH_SecretScanningAlert` | `false` |
+| `GH_Repository` | `GH_Branch` | `false` |
+| `GH_Repository` | `GH_BranchProtectionRule` | `false` |
+| `GH_Repository` | `GH_DeployKey` | `false` |
+| `GH_Repository` | `GH_Environment` | `false` |
+| `GH_Repository` | `GH_RepoRunner` | `false` |
+| `GH_Repository` | `GH_RepoSecret` | `false` |
+| `GH_Repository` | `GH_RepoVariable` | `false` |
+| `GH_Repository` | `GH_SecretScanningAlert` | `false` |
+| `GH_Repository` | `GH_Workflow` | `false` |
+| `GH_Workflow` | `GH_WorkflowJob` | `false` |
+| `GH_WorkflowJob` | `GH_WorkflowStep` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_Enterprise"]
+    n1["GH_ClassicPersonalAccessToken"]
+    n2["GH_EnterpriseRole"]
+    n3["GH_EnterpriseRunnerGroup"]
+    n4["GH_EnterpriseTeam"]
+    n5["GH_Organization"]
+    n6["GH_EnterpriseRunner"]
+    n7["GH_Environment"]
+    n8["GH_EnvironmentBranchPolicy"]
+    n9["GH_EnvironmentSecret"]
+    n10["GH_EnvironmentVariable"]
+    n11["GH_OrgRunnerGroup"]
+    n12["GH_OrgRunner"]
+    n13["GH_AppInstallation"]
+    n14["GH_OrgRole"]
+    n15["GH_OrgSecret"]
+    n16["GH_OrgVariable"]
+    n17["GH_PersonalAccessToken"]
+    n18["GH_PersonalAccessTokenRequest"]
+    n19["GH_SecretScanningAlert"]
+    n20["GH_Repository"]
+    n21["GH_Branch"]
+    n22["GH_BranchProtectionRule"]
+    n23["GH_DeployKey"]
+    n24["GH_RepoRunner"]
+    n25["GH_RepoSecret"]
+    n26["GH_RepoVariable"]
+    n27["GH_Workflow"]
+    n28["GH_WorkflowJob"]
+    n29["GH_WorkflowStep"]
+    n0 -.->|GH_Contains| n1
+    n0 -.->|GH_Contains| n2
+    n0 -.->|GH_Contains| n3
+    n0 -.->|GH_Contains| n4
+    n0 -.->|GH_Contains| n5
+    n3 -.->|GH_Contains| n6
+    n7 -.->|GH_Contains| n8
+    n7 -.->|GH_Contains| n9
+    n7 -.->|GH_Contains| n10
+    n11 -.->|GH_Contains| n12
+    n5 -.->|GH_Contains| n13
+    n5 -.->|GH_Contains| n14
+    n5 -.->|GH_Contains| n11
+    n5 -.->|GH_Contains| n15
+    n5 -.->|GH_Contains| n16
+    n5 -.->|GH_Contains| n17
+    n5 -.->|GH_Contains| n18
+    n5 -.->|GH_Contains| n19
+    n20 -.->|GH_Contains| n21
+    n20 -.->|GH_Contains| n22
+    n20 -.->|GH_Contains| n23
+    n20 -.->|GH_Contains| n7
+    n20 -.->|GH_Contains| n24
+    n20 -.->|GH_Contains| n25
+    n20 -.->|GH_Contains| n26
+    n20 -.->|GH_Contains| n19
+    n20 -.->|GH_Contains| n27
+    n27 -.->|GH_Contains| n28
+    n28 -.->|GH_Contains| n29
+```

openhound_github-0.17.0/descriptions/edges/GH_HasPersonalAccessToken.md

@@ -0,0 +1,23 @@
+# GH_HasPersonalAccessToken
+
+## General Information
+
+The non-traversable GH_HasPersonalAccessToken edge links a user to a personal access token they own. Fine-grained token ownership comes from organization approvals; classic token ownership comes from the enterprise credential inventory. The edge identifies the owner but does not by itself grant access to any organization or repository.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_User` | `GH_ClassicPersonalAccessToken` | `false` |
+| `GH_User` | `GH_PersonalAccessToken` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_User"]
+    n1["GH_ClassicPersonalAccessToken"]
+    n2["GH_PersonalAccessToken"]
+    n0 -.->|GH_HasPersonalAccessToken| n1
+    n0 -.->|GH_HasPersonalAccessToken| n2
+```

openhound_github-0.17.0/descriptions/nodes/GH_ClassicPersonalAccessToken.md

@@ -0,0 +1,43 @@
+# GH_ClassicPersonalAccessToken
+
+## General Information
+
+A classic personal access token found in the enterprise credential inventory.
+
+## Properties
+
+| Property | Type | Description |
+| --- | --- | --- |
+| `name` | `string` | The node name used for matching and display. |
+| `displayname` | `string` | The human-readable display name. |
+| `environmentid` | `string` | The identifier of the GitHub environment where this node was collected. |
+| `last_seen` | `datetime` | The timestamp when this node was last observed during collection. |
+| `node_id` | `string` | The stable identifier used as the OpenGraph node ID; this is the native GitHub node ID where available. |
+| `credential_id` | `integer` | GitHub's ID for this classic personal access token. |
+| `owner_id` | `integer` | GitHub's numeric ID for the token owner. |
+| `owner_login` | `string` | Login of the token owner. |
+| `scopes` | `list[string]` | OAuth scopes granted to the token. |
+| `credential_state` | `string` | Whether GitHub reports the credential as active, expired, revoked, or deleted. |
+| `expiry_status` | `string` | Whether expiration is scheduled, never, or unknown. |
+| `enterprise_authorized` | `boolean` | Whether the credential is authorized directly for the enterprise. |
+| `authorization_count` | `integer` | Total organization authorizations plus enterprise authorization. |
+| `inventory_as_of` | `string` | Timestamp of the export snapshot used to observe the token. |
+| `created_at` | `datetime` | Token creation time reported by GitHub. |
+| `last_used_at` | `datetime` | Last use time reported by GitHub. |
+| `expires_at` | `datetime` | Token expiration time reported by GitHub. |
+| `authorized_organizations` | `list[string]` | Organizations with a reported credential authorization. |
+| `environment_name` | `string` | Enterprise environment name. |
+| `enterprise_name` | `string` | Enterprise from which the inventory was exported. |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_ClassicPersonalAccessToken"]
+    n1["GH_Organization"]
+    n2["GH_Enterprise"]
+    n3["GH_User"]
+    n0 -.->|GH_AuthorizedForOrganization| n1
+    n2 -.->|GH_Contains| n0
+    n3 -.->|GH_HasPersonalAccessToken| n0
+```

{openhound_github-0.16.1 → openhound_github-0.17.0}/descriptions/nodes/GH_Enterprise.md

@@ -34,41 +34,43 @@ A GitHub Enterprise account that contains organizations, enterprise teams, roles
 ```mermaid
 graph LR
     n0["GH_Enterprise"]
-    n1["GH_EnterpriseManagedUser"]
-    n2["GH_EnterpriseRole"]
-    n3["GH_EnterpriseRunnerGroup"]
-    n4["GH_EnterpriseTeam"]
-    n5["GH_Organization"]
-    n6["GH_SamlIdentityProvider"]
-    n7["GH_User"]
-    n0 -.->|GH_HasMember| n1
-    n0 -.->|GH_Contains| n2
+    n1["GH_ClassicPersonalAccessToken"]
+    n2["GH_EnterpriseManagedUser"]
+    n3["GH_EnterpriseRole"]
+    n4["GH_EnterpriseRunnerGroup"]
+    n5["GH_EnterpriseTeam"]
+    n6["GH_Organization"]
+    n7["GH_SamlIdentityProvider"]
+    n8["GH_User"]
+    n0 -.->|GH_Contains| n1
+    n0 -.->|GH_HasMember| n2
     n0 -.->|GH_Contains| n3
     n0 -.->|GH_Contains| n4
     n0 -.->|GH_Contains| n5
-    n0 -.->|GH_HasSamlIdentityProvider| n6
-    n0 -.->|GH_HasMember| n7
-    n2 -.->|GH_CreateEnterpriseOrganizations| n0
-    n2 -.->|GH_EditEnterpriseCustomPropertiesForOrganizations| n0
-    n2 -->|GH_ManageEnterpriseAdmins| n0
-    n2 -.->|GH_ManageEnterpriseIdentityProvider| n0
-    n2 -->|GH_ManageEnterpriseMembers| n0
-    n2 -->|GH_ManageEnterpriseOrganizationAdmins| n0
-    n2 -.->|GH_ManageEnterpriseOrganizations| n0
-    n2 -.->|GH_ManageEnterpriseReferrals| n0
-    n2 -.->|GH_ManageEnterpriseTeams| n0
-    n2 -.->|GH_ReadEnterpriseAuditLog| n0
-    n2 -.->|GH_ReadEnterpriseDomainVerification| n0
-    n2 -.->|GH_ReadEnterpriseMembers| n0
-    n2 -.->|GH_ReadEnterpriseOrgProjects| n0
-    n2 -.->|GH_ReadEnterpriseOrganizationAdmin| n0
-    n2 -.->|GH_SetEnterpriseInteractionLimits| n0
-    n2 -.->|GH_ViewEnterpriseActionsUsageMetrics| n0
-    n2 -.->|GH_ViewEnterpriseBilling| n0
-    n2 -.->|GH_ViewEnterpriseSecretScanningAlerts| n0
-    n2 -.->|GH_WriteEnterpriseActionsPolicies| n0
-    n2 -.->|GH_WriteEnterpriseBilling| n0
-    n2 -.->|GH_WriteEnterprisePersonalAccessTokenPolicies| n0
-    n2 -.->|GH_WriteEnterpriseSso| n0
-    n2 -.->|GH_WriteEnterpriseTeamMembers| n0
+    n0 -.->|GH_Contains| n6
+    n0 -.->|GH_HasSamlIdentityProvider| n7
+    n0 -.->|GH_HasMember| n8
+    n3 -.->|GH_CreateEnterpriseOrganizations| n0
+    n3 -.->|GH_EditEnterpriseCustomPropertiesForOrganizations| n0
+    n3 -->|GH_ManageEnterpriseAdmins| n0
+    n3 -.->|GH_ManageEnterpriseIdentityProvider| n0
+    n3 -->|GH_ManageEnterpriseMembers| n0
+    n3 -->|GH_ManageEnterpriseOrganizationAdmins| n0
+    n3 -.->|GH_ManageEnterpriseOrganizations| n0
+    n3 -.->|GH_ManageEnterpriseReferrals| n0
+    n3 -.->|GH_ManageEnterpriseTeams| n0
+    n3 -.->|GH_ReadEnterpriseAuditLog| n0
+    n3 -.->|GH_ReadEnterpriseDomainVerification| n0
+    n3 -.->|GH_ReadEnterpriseMembers| n0
+    n3 -.->|GH_ReadEnterpriseOrgProjects| n0
+    n3 -.->|GH_ReadEnterpriseOrganizationAdmin| n0
+    n3 -.->|GH_SetEnterpriseInteractionLimits| n0
+    n3 -.->|GH_ViewEnterpriseActionsUsageMetrics| n0
+    n3 -.->|GH_ViewEnterpriseBilling| n0
+    n3 -.->|GH_ViewEnterpriseSecretScanningAlerts| n0
+    n3 -.->|GH_WriteEnterpriseActionsPolicies| n0
+    n3 -.->|GH_WriteEnterpriseBilling| n0
+    n3 -.->|GH_WriteEnterprisePersonalAccessTokenPolicies| n0
+    n3 -.->|GH_WriteEnterpriseSso| n0
+    n3 -.->|GH_WriteEnterpriseTeamMembers| n0
 ```

{openhound_github-0.16.1 → openhound_github-0.17.0}/descriptions/nodes/GH_Organization.md

@@ -90,40 +90,42 @@ Represents a GitHub organization. This is the root node of the graph and serves
 
 ```mermaid
 graph LR
-    n0["GH_Enterprise"]
+    n0["GH_ClassicPersonalAccessToken"]
     n1["GH_Organization"]
-    n2["GH_EnterpriseTeam"]
-    n3["GH_OrgRole"]
-    n4["GH_AppInstallation"]
-    n5["GH_OrgRunnerGroup"]
-    n6["GH_OrgSecret"]
-    n7["GH_OrgVariable"]
-    n8["GH_PersonalAccessToken"]
-    n9["GH_PersonalAccessTokenRequest"]
-    n10["GH_Repository"]
-    n11["GH_SamlIdentityProvider"]
-    n12["GH_SecretScanningAlert"]
-    n0 -.->|GH_Contains| n1
-    n2 -.->|GH_AssignedTo| n1
-    n3 -.->|GH_AddCollaborator| n1
-    n3 -.->|GH_CanCreateInternalRepositories| n1
-    n3 -.->|GH_CanCreatePrivateRepositories| n1
-    n3 -.->|GH_CanCreatePublicRepositories| n1
-    n3 -.->|GH_CanCreateRepositories| n1
-    n3 -.->|GH_CreateTeam| n1
-    n3 -.->|GH_InviteMember| n1
-    n3 -.->|GH_ResolveSecretScanningAlerts| n1
-    n3 -.->|GH_TransferRepository| n1
-    n3 -.->|GH_ViewSecretScanningAlerts| n1
-    n1 -.->|GH_Contains| n4
-    n1 -.->|GH_Contains| n3
+    n2["GH_Enterprise"]
+    n3["GH_EnterpriseTeam"]
+    n4["GH_OrgRole"]
+    n5["GH_AppInstallation"]
+    n6["GH_OrgRunnerGroup"]
+    n7["GH_OrgSecret"]
+    n8["GH_OrgVariable"]
+    n9["GH_PersonalAccessToken"]
+    n10["GH_PersonalAccessTokenRequest"]
+    n11["GH_Repository"]
+    n12["GH_SamlIdentityProvider"]
+    n13["GH_SecretScanningAlert"]
+    n0 -.->|GH_AuthorizedForOrganization| n1
+    n2 -.->|GH_Contains| n1
+    n3 -.->|GH_AssignedTo| n1
+    n4 -.->|GH_AddCollaborator| n1
+    n4 -.->|GH_CanCreateInternalRepositories| n1
+    n4 -.->|GH_CanCreatePrivateRepositories| n1
+    n4 -.->|GH_CanCreatePublicRepositories| n1
+    n4 -.->|GH_CanCreateRepositories| n1
+    n4 -.->|GH_CreateTeam| n1
+    n4 -.->|GH_InviteMember| n1
+    n4 -.->|GH_ResolveSecretScanningAlerts| n1
+    n4 -.->|GH_TransferRepository| n1
+    n4 -.->|GH_ViewSecretScanningAlerts| n1
     n1 -.->|GH_Contains| n5
+    n1 -.->|GH_Contains| n4
     n1 -.->|GH_Contains| n6
     n1 -.->|GH_Contains| n7
     n1 -.->|GH_Contains| n8
     n1 -.->|GH_Contains| n9
-    n1 -->|GH_Owns| n10
-    n1 -.->|GH_HasSamlIdentityProvider| n11
-    n1 -.->|GH_Contains| n12
-    n8 -.->|GH_CanAccess| n1
+    n1 -.->|GH_Contains| n10
+    n1 -->|GH_Owns| n11
+    n1 -.->|GH_HasSamlIdentityProvider| n12
+    n1 -.->|GH_Contains| n13
+    n9 -.->|GH_CanAccess| n1
 ```

{openhound_github-0.16.1 → openhound_github-0.17.0}/descriptions/nodes/GH_User.md

@@ -36,14 +36,15 @@ graph LR
     n4["GH_SecretScanningAlert"]
     n5["GH_Branch"]
     n6["GH_BranchProtectionRule"]
-    n7["GH_DeployKey"]
-    n8["GH_EnterpriseRole"]
-    n9["GH_Environment"]
-    n10["GH_OrgRole"]
-    n11["GH_PersonalAccessToken"]
-    n12["GH_PersonalAccessTokenRequest"]
-    n13["GH_RepoRole"]
-    n14["GH_TeamRole"]
+    n7["GH_ClassicPersonalAccessToken"]
+    n8["GH_DeployKey"]
+    n9["GH_EnterpriseRole"]
+    n10["GH_Environment"]
+    n11["GH_OrgRole"]
+    n12["GH_PersonalAccessToken"]
+    n13["GH_PersonalAccessTokenRequest"]
+    n14["GH_RepoRole"]
+    n15["GH_TeamRole"]
     n0 -.->|GH_HasMember| n1
     n2 -.->|GH_MapsToUser| n1
     n3 -.->|GH_MapsToUser| n1
@@ -51,13 +52,14 @@ graph LR
     n1 -.->|GH_CanWriteBranch| n5
     n1 -.->|GH_BypassPullRequestAllowances| n6
     n1 -.->|GH_RestrictionsCanPush| n6
-    n1 -.->|GH_AddedDeployKey| n7
-    n1 -->|GH_HasRole| n8
-    n1 -.->|GH_ApprovesDeploymentTo| n9
-    n1 -->|GH_CanDeployToEnvironment| n9
-    n1 -->|GH_HasRole| n10
-    n1 -.->|GH_HasPersonalAccessToken| n11
-    n1 -.->|GH_HasPersonalAccessTokenRequest| n12
-    n1 -->|GH_HasRole| n13
+    n1 -.->|GH_HasPersonalAccessToken| n7
+    n1 -.->|GH_AddedDeployKey| n8
+    n1 -->|GH_HasRole| n9
+    n1 -.->|GH_ApprovesDeploymentTo| n10
+    n1 -->|GH_CanDeployToEnvironment| n10
+    n1 -->|GH_HasRole| n11
+    n1 -.->|GH_HasPersonalAccessToken| n12
+    n1 -.->|GH_HasPersonalAccessTokenRequest| n13
     n1 -->|GH_HasRole| n14
+    n1 -->|GH_HasRole| n15
 ```

{openhound_github-0.16.1 → openhound_github-0.17.0}/extension/saved_searches/README.md

@@ -40,7 +40,7 @@ Use the runner interception searches as a progression:
 | 1 | `active-leaked-secrets.json` | Active Leaked Secrets | Finds secret scanning alerts that are both unresolved and confirmed active. These are valid, usable credentials committed to source code and represent an immediate compromise risk. |
 | 2 | `secret-scanning-alerts.json` | Secret Scanning Alerts | Returns all repositories that have open secret scanning alerts. |
 | 3 | `pats-all-repo-access.json` | PATs with Access to All Repositories | Finds fine-grained personal access tokens scoped to all repositories. A single compromised token grants access to every repository in the organization. |
-| 4 | `expired-pats.json` | Expired Personal Access Tokens | Finds expired personal access tokens that still exist. Expired tokens should be cleaned up to reduce credential inventory and audit noise. |
+| 4 | `expired-pats.json` | Expired Personal Access Tokens | Finds expired fine-grained and classic personal access tokens, including tokens whose owner could not be resolved. Expired tokens should be cleaned up to reduce credential inventory and audit noise. |
 | 5 | `pending-pat-requests.json` | Pending PAT Requests | Finds pending fine-grained personal access token requests awaiting approval. Review these to ensure requested permissions are appropriate before granting access. |
 
 ### :orange_circle: High — Organization Security Posture

openhound_github-0.17.0/extension/saved_searches/expired-pats.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Expired Personal Access Tokens",
+  "query": "MATCH (token)\nWHERE (token:GH_PersonalAccessToken AND token.token_expired = true) OR (token:GH_ClassicPersonalAccessToken AND token.credential_state = 'expired')\nOPTIONAL MATCH p=(:GH_User)-[:GH_HasPersonalAccessToken]->(token)\nRETURN token, p\nLIMIT 1000",
+  "description": "Finds expired fine-grained and classic personal access tokens, including tokens whose owner could not be resolved. Expired tokens should be cleaned up to reduce credential inventory and audit noise."
+}

{openhound_github-0.16.1 → openhound_github-0.17.0}/extension/schema.json

@@ -76,6 +76,13 @@
           "markdown": {
             "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_Enterprise {objectid: '%s'})-[:GH_HasSamlIdentityProvider]->(idp:GH_SamlIdentityProvider)\\nOPTIONAL MATCH p1 = (idp)-[:GH_HasExternalIdentity]->(:GH_ExternalIdentity)-[:GH_MapsToUser]->(:GH_User)\\nRETURN p, p1\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the identity provider and mapped users for this enterprise in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
           }
+        },
+        "classic_personal_access_tokens": {
+          "title": "Classic Personal Access Tokens",
+          "position": 10,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_Enterprise {objectid: '%s'})-[:GH_Contains]->(:GH_ClassicPersonalAccessToken)\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View classic personal access tokens in this enterprise in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
         }
       }
     },
@@ -305,6 +312,13 @@
           "markdown": {
             "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_Organization {objectid: '%s'})-[:GH_HasSamlIdentityProvider]->(idp:GH_SamlIdentityProvider)\\nOPTIONAL MATCH p1 = (idp)-[:GH_HasExternalIdentity]->(:GH_ExternalIdentity)-[:GH_MapsToUser]->(:GH_User)\\nRETURN p, p1\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the identity provider and mapped users for this organization in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
           }
+        },
+        "classic_pat_authorizations": {
+          "title": "Classic PAT Authorizations",
+          "position": 9,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (:GH_ClassicPersonalAccessToken)-[:GH_AuthorizedForOrganization]->(selected:GH_Organization {objectid: '%s'})\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View classic PATs authorized for this organization in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
         }
       }
     },
@@ -1759,6 +1773,51 @@
         }
       }
     },
+    {
+      "name": "GH_ClassicPersonalAccessToken",
+      "display_name": "GitHub Classic Personal Access Token",
+      "description": "A classic personal access token found in the enterprise credential inventory",
+      "is_display_kind": true,
+      "icon": "key",
+      "color": "#F5A623",
+      "info": {
+        "description": {
+          "title": "Description",
+          "position": 1,
+          "markdown": {
+            "content": "## Overview\n\nRepresents a classic personal access token reported by the enterprise credential inventory. Organization edges record authorizations, while token scopes and owner permissions determine what the credential can do. Repository access is not enumerated by the inventory."
+          }
+        },
+        "inbound_traversable_relationships": {
+          "title": "Inbound Traversable GH Relationships",
+          "position": 2,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_ClassicPersonalAccessToken {objectid: '%s'})\\nWHERE false\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View direct inbound relationships in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        },
+        "outbound_traversable_relationships": {
+          "title": "Outbound Traversable GH Relationships",
+          "position": 3,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_ClassicPersonalAccessToken {objectid: '%s'})\\nWHERE false\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View direct outbound relationships in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        },
+        "owner": {
+          "title": "Owner",
+          "position": 4,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (:GH_User)-[:GH_HasPersonalAccessToken]->(selected:GH_ClassicPersonalAccessToken {objectid: '%s'})\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the owner of this personal access token in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        },
+        "organization_scope": {
+          "title": "Organization Scope",
+          "position": 5,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_ClassicPersonalAccessToken {objectid: '%s'})-[:GH_AuthorizedForOrganization]->(:GH_Organization)\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View organizations authorizing this token in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        }
+      }
+    },
     {
       "name": "GH_PersonalAccessToken",
       "display_name": "GitHub Personal Access Token",
@@ -2490,7 +2549,7 @@
     },
     {
       "name": "GH_HasPersonalAccessToken",
-      "description": "User owns this personal access token that has been granted access to the organization",
+      "description": "User owns a personal access token reported by GitHub",
       "is_traversable": false
     },
     {
@@ -2503,6 +2562,11 @@
       "description": "GitHub App is installed as this app installation on an organization",
       "is_traversable": true
     },
+    {
+      "name": "GH_AuthorizedForOrganization",
+      "description": "Classic personal access token has a recorded authorization for this organization",
+      "is_traversable": false
+    },
     {
       "name": "GH_CanAccess",
       "description": "Personal access token, app installation, or deploy key can access this repository or organization",