Proof · GitHub REST API · June 2026

From 40 to 80 on GitHub’s riskiest REST endpoints

We ran APIThreshold on five of the most dangerous operations in GitHub’s official REST API. A typical happy-path test suite scored 40 out of 100 and did not pass the quality check. After APIThreshold generated tests, the suite scored 80 out of 100, covered security cases across all five endpoints, and passed the same check — in about 15 minutes.

Summary

GitHub publishes a 600+ operation OpenAPI description. We scoped APIThreshold to five highest-risk endpoints — repo deletion, ownership transfer, collaborator permissions, branch protection, and deploy-key creation. The risk assessor auto-flagged all five as P0 critical.

Our naive baseline only checked success responses. APIThreshold generated the auth, permission, and guardrail tests a production reviewer would expect — then scored the result and ran a warning-mode quality check (80% bar, free tier).

Before / after

Five endpoints under test

What it caught

The baseline only asserted happy paths. Generated tests added the cases a security review would demand:

Auth failure (401/403) — baseline had none:

# tests-generated/test_POST_repo_keys_security_unauthenticated_and_permission_checks.py
resp_unauth = requests.post(endpoint, json=payload)  # no Authorization header
assert resp_unauth.status_code == 401
# ...
assert resp_forbidden.status_code == 403  # authenticated but not admin

Branch protection — entirely absent in baseline:

# tests-generated/test_PUT_branch_protection_security_auth_and_admin_enforcement.py
assert r_unauth.status_code == 401   # unauthenticated
assert r_forbidden.status_code == 403  # no admin permission

Destructive delete guardrails — baseline only accepted 204/404:

# tests-generated/test_DELETE_repo_security_unauthenticated_and_unauthorized.py
assert resp_unauth.status_code in (401, 403)
# ... verify repo still exists after unauthorized delete attempt

How it works

Executed with APIThreshold CLI v0.1.0 and gpt-5-mini. Warning mode (80% threshold) on the free tier — enforcing mode (95%) requires Starter+.

Reproduce it

Full runbook, Makefile, and scored artifacts live in the public reproduction repo. Prereqs: OpenAI API key, APITHRESHOLD_MODEL=gpt-5-mini, then make all.

Caveats