RepoFabric
RepoFabric is a self-hosted WinGet source platform for Microsoft-managed fleets. It provides Entra ID sign-in, one-click Intune policy export (DesktopAppInstaller CSP) to point endpoints to a private source, Azure Arc readiness, and a GUI admin console. It also offers a REST API and a 48-cmdlet PowerShell module, GitOps manifests, scheduled sync, and LAN peer-caching to reduce bandwidth.
Security Analysis
50 files scanned on Aug 16, 2026
RepoFabric Client code provides admin-oriented functionality to configure Winget sources, intranet-zone mappings, and silent/install defaults for Intune-managed endpoints. While these capabilities are legitimate in a managed fleet, several patterns present security considerations: (1) intranet-zone mapping to bypass security prompts, (2) trusting remote WinGet REST sources, (3) profile-level persistence wrappers for Winget, and (4) optional CA certificate import into the root store. Additionally, bootstrap.sh contains a starter environment with placeholders for secrets that must be populated securely. Recommendations: enforce strict source trust, audit and restrict profile modifications, validate CA certificates against a known trusted store, and ensure bootstrap secrets are injected through secure, audited processes (e.g., MDM-provisioned vaults or CI/CD secret management).
You might also like
OIB Deployer
OIB Deployer automates the deployment of OpenIntuneBaseline configurations within Microsoft Intune, enabling rapid, repeatable rollouts of baseline security policies and device configurations. It supports policy templating, script deployment, and integration with community-provided baseline content, with built-in logging and error reporting for auditability. Ideal for IT admins seeking consistent, scalable endpoint security across devices.
James RobinsonTenuVault
TenuVault is a safe backup and restore solution for Microsoft Intune configurations. It backs up Intune policies to JSON files, detects configuration drift, and restores by creating new policies with a [Restored] prefix - never overwriting existing ones. It supports multiple export formats (JSON, CSV, HTML), full audit logs, and a read-only backup model with preview mode to ensure non-destructive changes.
Ugur KocWindows LAPS Self‑Service Portal
Windows LAPS Self-Service Portal lets users securely retrieve the LAPS password for their own device without helpdesk tickets. Built on Azure Static Web Apps + Azure Functions and Entra ID, it enforces an only-my-device rule, requires a justification, and auto-hides the password after 60 seconds. Every access is auditable in Azure Table Storage, with a zero-stored-secrets design and Graph access via a Managed Identity.
DUDE Manager
DUDE Manager is a Windows PowerShell WPF GUI that configures, deploys, and monitors the DUDE automation engine, which dynamically synchronizes Intune device groups with Entra ID user groups. The sync runs in Azure Functions with a Managed Identity, supports transitive membership and nested groups, and includes safety rails (no shared credentials, prefix allowlists, blast-radius limiter, debug mode). The GUI handles deployment and monitoring, with ARM64 browser login for devices lacking WAM, and supports delegation features via Administrative Units and Defender tags.
Daniel Petri