Pull request reviews not required before merging to the default branch

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_34
Category	Flow Control Mechanism
Severity	MEDIUM

Impact

User accounts granted with Write permissions on an actively used repository* can directly push code to the default branch, not required for pull request reviews before code is merged. Attackers compromising such a user account can directly push code to the default branch, which is likely to flow through the pipeline and be used in production systems.

• An actively used repository has at least two contributors, over 50 commits, and was updated in the last 90 days.

Recommended Solution - Buildtime

It is recommended to restrict direct pushes to the default branch, and to require pull request approvals to ensure the code is reviewed before merged. To configure require required pull request reviews:

1. Select a repository > Settings.
2. Under Branches, select add branch protection rule > edit the rule that applies to the default branch.
3. Check the Require a pull request reviews before merging rule.
4. Select the required request approvals from the options that are displayed.

Recommended: Select the Require review from Code Owners rule that is displayed when executing step 3 above.