Forking of a private GitHub repository is allowed

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_154
Category	Data Protection
Severity	MEDIUM

Impact

Forking is allowed on private repositories, allowing user accounts with 'read' permissions only to fork a repository to another organization or user account. This could lead to a decrease in security as SAML SSO may not be mandatory for authentication when accessing a forked repository. Another security concern is that pull requests can be generated from forked repositories, which may result in a PPE attack.