Forking of a private Azure repository is allowed

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_191
Category	Data Protection
Severity	MEDIUM

Impact

Forking is allowed on private repositories, allowing user accounts with ‘read’ permissions only to fork a repository to another project or user account. This could allow sensitive code to be inadvertently/intentionally leaked. Additionally, pull requests can be created from the forked repository to the original repository, which could potentially lead to the execution of malicious code on the CI, even by users with read-only permissions on the original repository.