SocketDev
diff --git a/‎socketsecurity/core/scm/github.py‎
Lines changed: 13 additions & 0 deletions b/‎socketsecurity/core/scm/github.py‎
Lines changed: 13 additions & 0 deletions
diff --git a/‎tests/unit/test_ignore_authorization.py‎
Lines changed: 12 additions & 0 deletions b/‎tests/unit/test_ignore_authorization.py‎
Lines changed: 12 additions & 0 deletions
@@ -4,6 +4,7 @@
 from dataclasses import dataclass
 
 from git import Optional
+from socketdev.exceptions import APIFailure
 
 from socketsecurity import USER_AGENT
 from socketsecurity.core import log
@@ -273,6 +274,18 @@ def is_ignore_authorized(self, comment: Comment) -> bool:
                     permission = (
                         result["permission"].casefold() in self.WRITE_PERMISSIONS
                     )
+            except APIFailure as error:
+                # GitHub returns 404 when the user is not a collaborator (or
+                # the caller cannot see the repo). Comments were already listed
+                # with this token, so 404 is the outsider case, not missing
+                # scope, and must not fail open under enforce.
+                if error.status_code == 404:
+                    permission = False
+                else:
+                    log.warning(
+                        f"Could not read GitHub repository permission for {author}: {error}"
+                    )
+                    permission = None
             except Exception as error:
                 log.warning(
                     f"Could not read GitHub repository permission for {author}: {error}"
 
@@ -8,6 +8,7 @@
 from types import SimpleNamespace
 
 import pytest
+from socketdev.exceptions import APIFailure
 
 from socketsecurity.core.classes import Comment
 from socketsecurity.core.scm.github import Github
@@ -81,6 +82,17 @@ def test_github_unreadable_permission_honors_the_command_with_a_warning(caplog):
     assert "without verifying write access" in caplog.text
 
 
+def test_github_404_means_the_commenter_is_not_a_collaborator():
+    """GitHub returns 404 when the user is not a collaborator. That is the
+    drive-by case this gate exists to block, not an undetermined lookup."""
+    github = _github(
+        raises=APIFailure("Request failed: 404 Client Error", status_code=404)
+    )
+    comment = _comment(user={"login": "outsider"}, author_association="NONE")
+
+    assert github.is_ignore_authorized(comment) is False
+
+
 def test_github_strict_rejects_when_permission_cannot_be_read(caplog):
     github = _github(raises=Exception("403 Forbidden"), policy="strict")