# Introducing Moat: A Security Review for Your GitHub Account

DevFeed: [Introducing Moat: A Security Review for Your GitHub Account](<https://devfeed.tech/articles/introducing-moat-a-security-review-for-your-github-account-3882.md>)

Original publisher: [Read original article](<https://laravel.com/blog/moat-a-security-review-for-your-github-account>)

Author: Nuno Maduro

Published: 2026-05-25T11:30:00Z

Content type: article

Language: en

Sources: [Laravel Blog](<https://devfeed.tech/sources/laravel-blog.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [ci](<https://devfeed.tech/tags/ci.md>), [github](<https://devfeed.tech/tags/github.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [pull-request](<https://devfeed.tech/tags/pull-request.md>), [review](<https://devfeed.tech/tags/review.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

The article introduces Moat, a read-only package that reviews the security posture of GitHub users, organizations, and repositories. It checks settings such as two-factor authentication, branch protection, signed commits, secret scanning, Dependabot alerts, workflow permissions, pinned actions, webhooks, and collaborator access, then reports configuration gaps and suggestions. The article emphasizes that Moat does not change settings, certify security, remediate compromises, or scan dependencies.

## Source excerpt

Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more.