Reviews may no longer be required before merging

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_142
Category	Flow Control Mechanism
Severity	MEDIUM

Impact

Removing code reviews from protected branches eliminates an essential security measure designed to prevent unreviewed code that may contain security bugs and/or malicious commits being pushed to repository branches.

Recommended Solution - Buildtime

Verify the reason for removing required reviews. Consider adding a branch protection rule with the Require a pull request before merging setting enabled, and selecting at least 1 reviewer in the Require approvals field.

For more information refer to: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule