VNX-GH-202: Default branch merges without review

Protection exists but requires no approving review.

Updated 02 Nov 2026Checked against cli@24498404a, vdb-sca-match@v0.8.14

Without a required approval a single account, or a single stolen credential, can land any change on the default branch.


Severity	High
Confidence	high
CWE	CWE-862
Command	`vulnetix gha settings`, `vulnetix gha audit`
Needs	repo, branches. Without them the rule is reported as not evaluated, never as passed.

Remediation

Require at least one approving review (two for repositories that publish releases), and require approval of the most recent push.

Run only this rule

vulnetix gha settings --rule VNX-GH-202

Scoring

CWSS vector at the rule’s default severity: CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:M/EC:N/P:W. A finding whose severity the repository’s settings moved is scored at its adjusted severity.

All rules: GitHub rules.

Edit this pageSources: vdb-sca-match/ghaudit/rules_settings.go, cli/internal/ghtasks/docs.go