Back to Checks
github

Repository default branch protection applies to administrators

repository_default_branch_protection_applies_to_admins
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

GitHub repository default branch applies branch protection rules to administrators via enforce_admins, holding admin pushes to the same requirements as other contributors (reviews, status checks, and push restrictions). This protection can be enforced through classic branch protection or repository rulesets.

Prowler logoProwlerprowler-provider-github

Risk

Without admin enforcement, privileged users can bypass reviews and checks, enabling unauthorized code changes. A compromised admin token can inject backdoors, alter dependencies, or disable safeguards, undermining integrity, exposing secrets (confidentiality), and causing outages (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_default_branch_protection_applies_to_admins

Recommendation

Enable branch protection for administrators and disallow bypasses. Apply least privilege and separation of duties by requiring PR reviews, required status checks, and signed commits on critical branches. Limit force pushes and deletions, and regularly review admin roles and audit logs.

Remediation

CLI

gh api -X POST /repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection/enforce_admins

Terraform

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository     = "<example_resource_name>"
  branch         = "<DEFAULT_BRANCH>"
  enforce_admins = true  # Critical: applies branch protection to administrators
}

Other

1In GitHub, go to the repository > Settings > Branches
2Edit the branch protection rule that targets the default branch (or Add rule for <DEFAULT_BRANCH>)
3Enable: "Do not allow bypassing the above settings" (or "Include administrators")
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_default_branch_protection_applies_to_admins(Check):
    """Check if a repository enforces administrators to be subject to the same branch protection rules as other users

    This class verifies whether each repository enforces administrators to be subject to the same branch protection rules as other users.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Enforces Admin Branch Protection check

        Iterates over all repositories and checks if they enforce administrators to be subject to the same branch protection rules as other users.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository.
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.default_branch.enforce_admins is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                report.status = "FAIL"
                report.status_extended = f"Repository {repo.name} does not enforce administrators to be subject to the same branch protection rules as other users."
                if repo.default_branch.enforce_admins_source == "ruleset_not_active":
                    report.status_extended = f"Repository {repo.name} has a ruleset that would apply to administrators, but the ruleset is not active."

                if repo.default_branch.enforce_admins:
                    report.status = "PASS"
                    report.status_extended = f"Repository {repo.name} does enforce administrators to be subject to the same branch protection rules as other users."

                findings.append(report)

        return findings

References