"Require review from Code Owners" Branch Protection rule was disabled

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_116
Category	Flow Control Mechanism
Severity	MEDIUM

Impact

Disabling the "Require review from Code Owners" rule creates a critical Supply Chain vulnerability by allowing unauthorized changes to reach your production environment without expert oversight. This bypasses the "Four-Eyes" principle, enabling a compromised account or insider threat to inject malicious code into sensitive files like build scripts, CI/CD pipelines, or dependency manifests. Consequently, an attacker can ship a backdoored version of your software that appears legitimate to downstream customers because it was signed and distributed by your trusted internal processes.

Recommended Solution - Buildtime

• Verify the reason for removing the CODEOWNERS file.
• Consider restoring the deleted CODEOWNERS file.