VNX-GH-205: Force pushes or deletion allowed on the default branch

Protection permits force pushes or deleting the branch.

Updated 02 Nov 2026Checked against cli@24498404a, vdb-sca-match@v0.8.14

A force push rewrites history that downstream builds, tags and audits rely on, and can remove a reviewed change after the fact.


Severity	High
Confidence	high
CWE	CWE-284
Command	`vulnetix gha settings`, `vulnetix gha audit`
Needs	repo, branches. Without them the rule is reported as not evaluated, never as passed.

Remediation

Block force pushes and deletions on the default branch.

Run only this rule

vulnetix gha settings --rule VNX-GH-205

Scoring

CWSS vector at the rule’s default severity: CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:M/EC:N/P:W. A finding whose severity the repository’s settings moved is scored at its adjusted severity.

All rules: GitHub rules.

Edit this pageSources: vdb-sca-match/ghaudit/rules_settings.go, cli/internal/ghtasks/docs.go