Force push to default branch is allowed

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_31
Category	Data Protection
Severity	LOW

Impact

User accounts with Write permissions can force push to a default branch of an actively used repository and overwrite the commit history. If the repository is not stored on another source, a malicious user account can permanently delete the entire git history of the repository. An actively used repository has at least two contributors, over 50 commits, and was updated in the last 90 days.

Recommended Solution - Buildtime

To restrict force push on the default branch:

1. Browse to the repository Settings.
2. Under Branches, edit the rule that applies to the repository default branch.
3. Uncheck the Allow force pushes setting.