Cortex CloudApplication Security
Auto-merge configured in pipeline
Rule Details
Cortex AppSec Rule ID
APPSEC_CICD_118
Category
Artifact Integrity Validation
Severity
MEDIUM
Impact
Auto-merge logic in pipelines is usually executed when conditions that check for minor changes in the code are met. These conditions may contain flaws, allowing attackers with "write" access to take advantage of them in order to bypass pull request reviews and to merge malicious code to protected branches.
Recommended Solution - Buildtime
We recommend removing auto-merge logic from pipelines.
PreviousMissing integrity check for downloaded executable in GitHub Actions pipeline
NextMissing integrity check for downloaded executable in GitLab CI pipeline
Last updated
Was this helpful?