Critical-risk tools in Forgejo
67 of the 457 tools in Forgejo are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
admin_delete_hookDestructiveDelete a global (system) webhook (requires admin privileges)
-
admin_delete_quota_groupDestructiveDelete a quota group (requires admin privileges)
-
admin_delete_quota_ruleDestructiveDelete a quota rule (requires admin privileges)
-
admin_delete_runnerDestructiveDelete an Actions runner of the instance (requires admin privileges)
-
admin_delete_unadopted_repoDestructiveDelete unadopted repository files (requires admin privileges)
-
admin_delete_userDestructiveDelete a user (requires admin privileges)
-
admin_delete_user_emailsDestructiveDelete email addresses from a user
-
admin_delete_user_keyDestructiveRemove an SSH public key from a user
-
admin_delete_user_tokenDestructiveDelete an access token of a user (requires admin privileges)
-
admin_remove_quota_group_ruleDestructiveRemove a rule from a quota group (requires admin privileges)
-
admin_remove_quota_group_userDestructiveRemove a user from a quota group (requires admin privileges)
-
clear_issue_labelsDestructiveRemove all labels from an issue
-
clear_repo_flagsDestructiveRemove all flags from a repository (instance admin only)
-
delete_action_artifactDestructiveMark an Actions artifact for deletion
-
delete_action_runDestructiveDelete a completed Actions workflow run
-
delete_branchDestructiveDelete a branch from a repository
-
delete_branch_protectionDestructiveDelete a branch protection rule
-
delete_comment_attachmentDestructiveDelete an issue comment attachment
-
delete_commit_noteDestructiveRemove the git note attached to a commit
-
delete_deploy_keyDestructiveDelete a deploy key from a repository
-
delete_fileDestructiveDelete a file from a repository
-
delete_issueDestructiveDelete an issue
-
delete_issue_attachmentDestructiveDelete an issue attachment
-
delete_issue_commentDestructiveDelete a comment on an issue
-
delete_issue_stopwatchDestructiveDelete an issue
-
delete_issue_tracked_timeDestructiveDelete a specific tracked time entry from an issue
-
delete_labelDestructiveDelete a label from a repository
-
delete_milestoneDestructiveDelete a milestone from a repository
-
delete_my_action_secretDestructiveDelete an Actions secret of the authenticated user
-
delete_my_action_variableDestructiveDelete an Actions variable of the authenticated user
-
delete_my_emailsDestructiveDelete email addresses from the authenticated user
-
delete_my_gpg_keyDestructiveRemove a GPG public key from the authenticated user
-
delete_my_hookDestructiveDelete one of the authenticated user
-
delete_my_runnerDestructiveDelete an Actions runner of the authenticated user
-
delete_my_ssh_keyDestructiveDelete an SSH public key from the authenticated user
-
delete_orgDestructiveDelete an organization
-
delete_org_action_secretDestructiveDelete an Actions secret of an organization
-
delete_org_action_variableDestructiveDelete an Actions variable of an organization
-
delete_org_hookDestructiveDelete a webhook from an organization
-
delete_org_labelDestructiveDelete an organization label
-
delete_org_runnerDestructiveDelete an Actions runner of an organization
-
delete_packageDestructiveDelete a specific version of a package
-
delete_pr_reviewDestructiveDelete a specific review from a pull request
-
delete_pr_review_commentDestructiveDelete a comment from a pull request review
-
delete_push_mirrorDestructiveRemove a push mirror from a repository by its remote name
-
delete_releaseDestructiveDelete a release by ID
-
delete_release_assetDestructiveDelete a release attachment
-
delete_release_by_tagDestructiveDelete a release by tag name
-
delete_repoDestructiveDelete a repository by owner and name
-
delete_repo_action_secretDestructiveDelete an Actions secret of a repository
-
delete_repo_action_variableDestructiveDelete an Actions variable of a repository
-
delete_repo_hookDestructiveDelete a webhook from a repository
-
delete_repo_runnerDestructiveDelete an Actions runner of a repository
-
delete_repo_topicDestructiveRemove a topic from a repository
-
delete_tagDestructiveDelete a repository
-
delete_tag_protectionDestructiveDelete a tag protection rule
-
delete_teamDestructiveDelete a team
-
delete_wiki_pageDestructiveDelete a wiki page
-
remove_collaboratorDestructiveRemove a collaborator from a repository
-
remove_comment_reactionDestructiveRemove a reaction from an issue comment
-
remove_issue_dependencyDestructiveRemove a dependency from an issue
-
remove_issue_reactionDestructiveRemove a reaction from an issue
-
remove_org_memberDestructiveRemove a member from an organization
-
remove_repo_teamDestructiveRemove a team from a repository
-
remove_team_memberDestructiveRemove a member from a team
-
remove_team_repoDestructiveRemove a repository from a team
-
reset_issue_tracked_timesDestructiveReset all tracked time of an issue
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.