Forking of a private repository is allowed

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_19
Category	Data Protection
Severity	MEDIUM

Impact

Misconfiguration of private repositories may allow sensitive code to be inadvertently/intentionally leaked. A user account might fork the repository to another project, leading to leakage of code. It can also lead to the creation of pull requests from the forked repository to the original repository. This can lead to the execution of malicious code on the CI, even by users with read-only permissions on the original repository.

Recommended Solution - Buildtime

When not required, disable the forking of private repositories.

To restrict forking of a private repository:

1. Browse to project Settings.
2. Under Visibility, select Project Features.
3. Disable the Fork setting under the Permissions section.