Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt

Use this file to discover all available pages before exploring further.

FieldValue
CategoryCICD-SEC-1
SeverityHIGH
Auto-fix✗
SourceRepository configuration

​
What the check does

Reads the branch protection rule and reports when enforce_admins.enabled is false.

​
Why it matters

Admin bypass turns every protection on the branch into “soft” enforcement:
  • A compromised admin PAT lets the attacker push directly to main.
  • Even well-intentioned admins routinely click “merge anyway” past failing checks — which then erodes the entire culture of CI as a gate.
  • This is the single biggest gap between a paper policy (“we require reviews”) and an enforced one.
GitHub’s own guidance is that branch protection should apply to everyone.

​
How to fix

Settings → Branches → edit the rule → enable Do not allow bypassing the above settings. (This is the modern UI label for enforce_admins.) Make sure no one is in the bypass list either.