Pull request reviews are not required in Azure Repos before merging to the default branch

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_179
Category	Pipeline Flow Control
Severity	MEDIUM

Impact

User accounts with "write" permissions on an actively used repository can push code directly to the default branch without requiring pull request reviews before the code is merged, potentially allowing malicious code to flow through the pipeline to production systems. * An actively used repository is defined as having at least two contributors, over 50 commits, and has been updated in the last 90 days.