Private repository made public

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_88
Category	Data Protection
Severity	CRITICAL

Impact

A private repository made public allows anyone to access the source code in the repository and to retrieve hard-coded credentials and potentially sensitive information. An attacker may also be able to perform a Public-PPE (3PE) attack and reach the production environment. For more on 3PE refer to https://www.paloaltonetworks.com/blog/prisma-cloud/poisoned-pipeline-execution-deep-dive/.

Note that the severity of this risk is reduced on self hosted instances that are not accessible over the internet.

Recommended Solution - Buildtime

Verify the reason for changing the repository’s visibility. If necessary, revert the repository visibility back to “private”. For more refer to https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility#changing-a-repositorys-visibility