GitHub
Releases
Security & compliance
Code quality
Default branch is unprotected
Part of the Repository protection posture check · fix arrives as a guide
What it is
The default branch has no protection rule, so it accepts direct pushes, force pushes, and deletion.
Why it matters
The branch you deploy from can be rewritten by anyone with write access, and a force push can erase commits with no record that they existed. Nothing requires review or a passing build.
How to fix it
Add a protection rule requiring a pull request and at least one approval, blocking force pushes and deletion, and requiring your CI checks to pass.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.