Description

Detects when the default branch of a GitHub repository has no branch protection rule. An unprotected default branch accepts direct pushes, force pushes and deletions from anyone with write access, and requires neither review nor passing status checks before code reaches the branch the organization releases from.

Detection Strategy

• Lists every repository in the GitHub organization, taking the default branch name and the caller's permissions from the listing itself

• Skips repositories where the credential lacks admin permission, because branch protection cannot be read without it and GitHub answers the same way for a branch that is unprotected and for one that cannot be seen

• Requests the branch protection settings of the default branch of each remaining repository

• Reports a vulnerability when GitHub answers that no protection rule exists for that branch