Identity Access Management

Rule Name	AppSec Rule ID	Severity
2FA is not enforced in SCM	APPSEC_CICD_1	HIGH
Unrotated deploy keys	APPSEC_CICD_6	LOW
Unrotated GitLab deploy keys	APPSEC_CICD_7	LOW
Unrotated access keys detected	APPSEC_CICD_8	LOW
Inactive SCM user accounts	APPSEC_CICD_16	MEDIUM
Jenkins provides full access to anonymous visitors	APPSEC_CICD_17	CRITICAL
Jenkins provides full access to authenticated user accounts	APPSEC_CICD_18	HIGH
User account is missing 2FA	APPSEC_CICD_22	HIGH
Permissive organization base permissions	APPSEC_CICD_29	LOW
Outside collaborators have admin access to a repository	APPSEC_CICD_35	HIGH
Deploy key has a weak SSH signature	APPSEC_CICD_36	LOW
Weak authentication service in use	APPSEC_CICD_49	MEDIUM
Jenkins provides read access to anonymous visitors	APPSEC_CICD_50	MEDIUM
No authentication is configured	APPSEC_CICD_51	HIGH
Access key with a weak SSH signature was detected in SCM	APPSEC_CICD_70	LOW
Excessive user permissions to a repository	APPSEC_CICD_89	HIGH
Excessive user permissions to a project	APPSEC_CICD_95	HIGH
Excessive user permissions to a BitBucket repository	APPSEC_CICD_96	HIGH
User account credentials (access token and/or SSH Keys) are inactive in GitHub	APPSEC_CICD_105	HIGH
Any organization member can create internal repositories	APPSEC_CICD_184	LOW
Any organization member can create private repositories	APPSEC_CICD_185	LOW
Default branch does not require signed commits	APPSEC_CICD_206	LOW