Merge request approvals not required for default branch

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_79
Category	Flow Control Mechanism
Severity	MEDIUM

Impact

Users granted with write permissions on an actively used repository* can push code directly to the default branch without requiring reviews. An attacker who gains control of a user with write permissions can push malicious code to the default branch. This code is likely to flow through the pipeline and be used in production systems. *An actively used repository has at least two contributors, over 50 commits, and was updated in the last 90 days.

Recommended Solution - Buildtime

1. Require merge request approvals:

   1. Browse to the General page under project Settings.
   2. Expand Merge request approvals and configure an approval rule requiring at least 2 reviewers in order to merge.
2. Review the Approval settings to add restrictions according to your needs. We recommend preventing approval by author.