Check ID:
Provider: GitHub
Service:
Severity: MEDIUM
Categories:
Resource type:
repository_default_branch_deletion_disabledProvider: GitHub
Service:
repositorySeverity: MEDIUM
Categories:
software-supply-chainResource type:
NotDefinedWhat this check verifies
GitHub repository default branch have branch protections or rulesets withAllow deletions disabled.
Risk
Permitting default branch deletion undermines availability by breaking CI/CD, releases, and PR targets. It also impacts integrity: the canonical ref can be removed, enabling history tampering, branch hijacking, and harder audits/rollbacks.Recommendation
Disable deletions on the default branch using branch protection or rulesets (Allow deletions=false). Apply controls to admins, minimize bypass lists, and enforce least privilege. Combine with required pull requests and status checks for defense in depth.
Remediation
- CLI
- Terraform
- Dashboard steps
gh api -X DELETE repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection/allow_deletions
References
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_default_branch_deletion_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks