> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CICD-SEC-1 — Default branch does not dismiss stale reviews on new commits

> Approvals survive new pushes. An attacker can land a clean review then sneak commits in before merge.

| Field    | Value                    |
| -------- | ------------------------ |
| Category | `CICD-SEC-1`             |
| Severity | MEDIUM                   |
| Auto-fix | ✗                        |
| Source   | Repository configuration |

## What the check does

Reads the branch protection rule and reports when `required_pull_request_reviews.dismiss_stale_reviews` is `false`.

## Why it matters

Without stale-review dismissal:

1. Author opens a clean PR.
2. Reviewer approves it.
3. Author force-pushes additional malicious commits.
4. PR is now merge-eligible — the approval still counts, even though the reviewed commit is no longer the HEAD.

This is the most common branch-protection bypass in the wild — defeats reviews without needing to compromise any account.

## How to fix

Settings → Branches → edit the rule → under **Require a pull request before merging**, enable **Dismiss stale pull request approvals when new commits are pushed**.