Detects when a GitHub organization policy is enabled to allow private repository forking (private_repository_forking.enable). This occurs within GitHub audit logs and can enable private forks that move code from the organization to personal accounts, creating a potential data exfiltration path and a surface for collection by an attacker following an org-owner compromise. The rule queries GitHub audit events to surface the enabling action and returns contextual fields for investigation (timestamp, actor identity, org, repository, actor IP, hashed token, programmatic access type, user agent, and repo visibility). The event is assigned a medium risk score (47) and is aligned to MITRE ATT&CK: Collection (T1213.003 - Code Repositories) and Defense Evasion (T1484 - Domain or Tenant Policy Modification). Investigation guidance emphasizes identifying the initiator (user.name), org, and actor_ip, assessing which repos were forked and to which accounts, and determining whether any private forks exist post-enablement. False positives may occur with approved inner-source programs that temporarily enable forking. Remediation suggests disabling private_repository_forking unless required, and reviewing/handling forks created within the same window (transfer or delete unauthorized copies). The rule references GitHub documentation on organization fork policies for context and governance.