Description

Detects when an identity may bypass the branch policies of an Azure DevOps repository's default branch, either by pushing past them or by completing a pull request that does not meet them. That identity can merge changes nobody reviewed and no build validated, so every other policy on the branch holds on paper and is defeated in practice.

Detection Strategy

• Lists every project in the Azure DevOps organization and every Git repository inside each project

• Skips repositories with no default branch, since a repository without commits has no branch to protect

• Reads the access control list of the default branch in the Git Repositories security namespace and resolves each identity's effective permission, with deny taken over allow

• Reports a vulnerability when any identity holds either bypass permission, the one for pushing or the one for completing pull requests, as a single finding since both defeat the same protection; a list that cannot be read or comes back empty is recorded as unreadable rather than reported as clean