GitLab
Releases
Security & compliance
Code quality
Default branch is unprotected (GitLab)
Part of the GitLab project protection check · fix arrives as a guide
What it is
The default branch is not protected, so it accepts direct pushes and force pushes from anyone with developer access.
Why it matters
The branch you deploy from can be changed without review and its history can be rewritten. A force push removes commits with no trace of what was there before.
How to fix it
Add a protected-branch rule for the default branch: no direct push, merge via merge request only, and force push disallowed.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.