Access to source code is among the most sensitive access an engineering team holds. A stolen password for an account that can change code is a path toward production.
GitHub lets an organization owner require two-factor authentication (2FA) for every member, outside collaborator and billing manager. We enforce it. It is not a setting we recommend to engineers — it is a requirement our GitHub organization applies automatically.
The mechanics matter: once required, a member who does not enable 2FA cannot access the organization's resources until they do — they do not get a grace period on live systems. An outside collaborator without 2FA is removed outright, and loses access to the organization's repositories, including forks of its private repositories. Unattended or shared accounts, such as bots and service accounts, need 2FA configured too, or the same removal applies to them.
We enforce it because recommended settings erode over time — a new hire can skip a recommendation, a reminder can be dismissed. A requirement does not need a follow-up; GitHub's platform applies it automatically on every login attempt, for every account, indefinitely.
What this does not mean
Requiring 2FA does not by itself certify every engineer's device or account is uncompromised, and it is only one control among several — it works alongside least-privilege repository access, mandatory pull-request review, and the automated scanning described on this page. We also don't claim our own account hygiene is certified by a third party; this is a policy we enforce and can be asked about directly.