Question

You are an enterprise owner rolling out a GitHub-recommended security configuration across a large organization. You apply the configuration and set it as the default. During review, a security manager notices that many pre-existing repositories still show no security features enabled, while brand-new repositories created afterward automatically receive the configuration. What is the most likely reason the existing repositories were not covered?

Accepted Answer

Setting a security configuration as the default only applies it automatically to newly created repositories; existing repositories must be attached to the configuration explicitly.

Answer

Security configurations can only be applied to repositories created after the enterprise was upgraded to GitHub Enterprise Cloud.

Answer

Existing repositories permanently opt out of any organization security configuration and can never be attached retroactively.

Answer

Default security configurations apply exclusively to public repositories, so private existing repositories are always skipped.