Pull request reviews in BitBucket not required before merging code to default branch

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_68
Category	Flow Control Mechanism
Severity	MEDIUM

Impact

User accounts granted with Write permissions on an actively used repository can directly push code to the default branch, not required for pull request reviews before code is merged. Attackers compromising such a user account can directly push code to the default branch, which is likely to flow through the pipeline and be used in production systems. An actively used repository has at least two contributors, over 50 commits, and was updated in the last 90 days.