Description

Detects when the protection rule of a GitHub repository's default branch does not require an approving review before merging. Without a required approval, a pull request can be merged by its own author, so no second person ever inspects the change that reaches the branch the organization releases from.

Detection Strategy

• Lists every repository in the GitHub organization, taking the default branch name and the caller's permissions from the listing itself

• Skips repositories where the credential lacks admin permission, since branch protection cannot be read without it

• Reads the count of required approving reviews from the branch protection settings, treating a protection rule that omits the pull request review block entirely as a count of zero

• Reports a vulnerability when fewer than one approving review is required