Push restrictions not enforced on the default branch

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_69
Category	Flow Control Mechanism
Severity	MEDIUM

Impact

An actively used repository* does not enforce restrictions limiting who can push or merge code directly to the default branch. This configuration allows users with 'write' permissions to bypass mandatory review and approval processes (such as pull requests). This lack of flow control creates a significant risk, as malicious code can be injected directly into the default branch, flow through the CI/CD pipeline, and reach production systems.

• An actively used repository has at least two contributors, over 50 commits, and has been updated in the last 90 days.

Recommended Solution - Buildtime

We recommend removing all entities from the Write access field of the default branch protection rule (which is unrelated to repository write permissions), to prevent unreviewed push of code:

1. Open the default branch settings editor: navigate to repository Settings > Branch permissions > edit the rule that applies to the default branch.
2. Delete all users and groups from the Write access field.