Update mobile app to enforce SOC2 security protocols like screen timeout, etc

[maebeale]

My workplace won't approve of us using github on mobile (web or native app) bc they can't enforce all the security required (lock screen, timeout, lost device process, etc). Do you have anything on the roadmap to offer enhanced security so managers like me can browse and review code from my phone?

[brianlovin]

Thanks for the message @maebeale — I'll flag this to our team, but in order to answer correctly it might be useful to have the specific requirements for mobile apps at your organization. For example, we don't support biometrics for the app itself, but the device itself has biometrics to unlock the phone. We also have a way to remotely revoke sessions through a user's security settings (https://github.com/settings/security) but there might be more specific managed needs at the company level.

[byennen]

This is a big issue for us. Any update on this? SSO has made this stop working and it's a SOC2 requirement for us. Thanks for the help!

[AzureCloudMonk]

Why does the GitHub Mobile iOS app not have an “App Lock” requiring a screen lock when you open the app using the Touch ID, mobile facial recognition or at least a mobile device PIN. Microsoft Authenticator, LastPass, and many other two-factor methods such as Authenticator apps require this. Since GitHub Mobile app is now an “Authenticator app” it should also have this security feature.