Check ID:
Provider: GitHub
Service:
Severity: HIGH
Categories:
Resource type:
repository_default_branch_protection_applies_to_adminsProvider: GitHub
Service:
repositorySeverity: HIGH
Categories:
identity-accessResource type:
NotDefinedWhat this check verifies
GitHub repository default branch applies branch protection rules to administrators viaenforce_admins, holding admin pushes to the same requirements as other contributors (reviews, status checks, and push restrictions).
Risk
Without admin enforcement, privileged users can bypass reviews and checks, enabling unauthorized code changes. A compromised admin token can inject backdoors, alter dependencies, or disable safeguards, undermining integrity, exposing secrets (confidentiality), and causing outages (availability).Recommendation
Enable branch protection for administrators and disallow bypasses. Apply least privilege and separation of duties by requiring PR reviews, required status checks, and signed commits on critical branches. Limit force pushes and deletions, and regularly review admin roles and audit logs.Remediation
- CLI
- Terraform
- Dashboard steps
gh api -X POST /repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection/enforce_admins
References
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#do-not-allow-bypassing-the-above-settings
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_default_branch_protection_applies_to_admins. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks