BitBucket private repository made public

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_245
Category	Data Protection
Severity	CRITICAL

Impact

A private repository made public allows anyone to access the source code in the repository and to retrieve hard-coded credentials and potentially sensitive information. An attacker might also perform a Public-PPE (3PE) attack and reach the production environment. For more on 3PE see https://www.paloaltonetworks.com/blog/prisma-cloud/poisoned-pipeline-execution-deep-dive Note that the severity of this risk is reduced on self hosted instances that are not accessible over the internet.