Back to Checks
github

Repository enforces branch protection on the default branch

repository_default_branch_protection_enabled
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:identity-accesssoftware-supply-chain
Resource Type:NotDefined

GitHub repository default branch has branch protection rules enabled to restrict direct changes and require reviewed, validated merges. The evaluation determines whether the default branch enforces such rules. This protection can be enforced through classic branch protection or repository rulesets.

Prowler logoProwlerprowler-provider-github

Risk

Without default-branch protection, changes can bypass reviews and checks, enabling:

  • Unauthorized direct pushes/force pushes
  • Malicious code injection and workflow tampering
  • Accidental deletions or unstable releases This undermines code integrity and service availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_default_branch_protection_enabled

Recommendation

Enforce branch protection on the default branch:

  • Require pull requests with approvals (least privilege)
  • Enforce required status checks and conversation resolution
  • Require signed commits and linear history; block force pushes/deletions
  • Restrict push to trusted actors and apply rules to admins Use CODEOWNERS to strengthen review accountability.

Remediation

CLI

gh api -X PUT repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection -f required_status_checks='null' -f required_pull_request_reviews='null' -f enforce_admins=false -f restrictions='null'

Terraform

# Enable branch protection on the default branch
# Minimal: create a protection rule targeting the default branch

data "github_repository" "repo" {
  full_name = "<OWNER>/<REPO>"
}

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository_id = data.github_repository.repo.node_id
  pattern       = "<DEFAULT_BRANCH>"  # Critical: protects the default branch so the check passes
}

Other

1In GitHub, open the repository and go to Settings
2Under "Code and automation", click Branches
3Click Add rule under "Branch protection rules"
4Set Branch name pattern to the default branch (e.g., main)
5Click Create to save the rule

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_default_branch_protection_enabled(Check):
    """Check if a repository enforces default branch protection

    This class verifies whether each repository enforces default branch protection.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Enforces Default Branch Protection check

        Iterates over all repositories and checks if they enforce default branch protection.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.default_branch.protected is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                report.status = "FAIL"
                report.status_extended = f"Repository {repo.name} does not enforce branch protection on default branch ({repo.default_branch.name})."
                if repo.default_branch.protected_source == "ruleset_not_active":
                    report.status_extended = f"Repository {repo.name} has a ruleset configured on default branch ({repo.default_branch.name}), but the ruleset is not active."

                if repo.default_branch.protected:
                    report.status = "PASS"
                    report.status_extended = f"Repository {repo.name} does enforce branch protection on default branch ({repo.default_branch.name})."

                findings.append(report)

        return findings

References