Default branch protected (SEC_BRANCH_PROTECTION)

Code SEC_BRANCH_PROTECTION · Severity Required · Category Security · Applies to Universal

Retired

This rule has been retired and is no longer checked. Branch protection is a Git provider setting, so Git Health reads it: see GIT_DEFAULT_BRANCH_PROTECTED, and its force-push and direct-push rules. Findings recorded before the change stay in the history.

Default branch should have branch protection enabled (required reviews, no force push). On GitHub and GitLab this is queryable; on Bitbucket/ADO it’s best-effort.

What is checked

The scan queries your git provider’s API for whether the default branch is protected. For GitHub and GitLab the protection state is read directly; for Bitbucket and Azure DevOps this check is best-effort and may not always be conclusive.

If the default branch is protected the rule passes; if there’s no protection, it fails.

Why it matters

An unprotected default branch lets unreviewed code land straight on main, allows history to be rewritten with force push, and lets CI checks be bypassed. Branch protection closes these gaps with required reviews, passing status checks, and a force-push block.

How to comply

GitHub: Settings → Branches → add a protection rule for the default branch; enable “Require a pull request before merging” and “Do not allow force pushes”.

GitLab: Settings → Repository → Protected branches → add the default branch; set “Allowed to force push” off and require approval to merge.

Bitbucket / Azure DevOps: Configure branch permissions/policies from repository settings (required reviewers, force-push block).

After configuring it, re-run the scan.