Description

Detects when the branch policies of an Azure DevOps repository do not require an approving review before a pull request completes into the default branch. With no required approval, a change can be completed by the person who wrote it, so no second pair of eyes ever inspects what reaches the branch the organization releases from.

Detection Strategy

• Lists every project in the Azure DevOps organization and every Git repository inside each project

• Keeps only the policies that are enabled, blocking and not deleted, and looks among them for the reviewer policy, matched by its type identifier

• Reads the minimum approver count from that policy, treating a branch whose enforced policies include no reviewer policy at all as a count of zero

• Reports a vulnerability when fewer than one approving review is required to complete a pull request