Description

Detects when the protection rule of a GitHub repository's default branch permits force pushes. A force push rewrites the branch history, so commits that were reviewed and merged can be replaced or removed without leaving a trace in the branch, defeating the audit trail the protection rule exists to provide.

Detection Strategy

• Lists every repository in the GitHub organization, taking the default branch name and the caller's permissions from the listing itself

• Skips repositories where the credential lacks admin permission, since branch protection cannot be read without it

• Requests the branch protection settings of the default branch and reads the nested enabled flag of the force push setting

• Reports a vulnerability when force pushes are allowed; a branch with no protection rule at all is left to the protection check so that one setting does not produce two findings