← All keys & policies
Policy·repository
Environment protection rules
Tier 1 · HighManagement
Why Tier 1
Decides who must approve a deployment and from which branches, which is the gate in front of production secrets.
Required reviewers, wait timers and deployment branch policies for a repository's deployment environments.
Available on: Free (public repositories only), Team (reviewers and wait timers on public repositories only; branch rules on private ones too), Enterprise Cloud, EMU, Server. Source
Attack path
Removing required reviewers or loosening the deployment branch policy on a production environment lets an attacker's branch deploy straight to production without a second set of eyes.
Mitigations
- Restrict deployments to protected branches
- Alert on changes to production environments
Detect
Alert on environment.remove_protection_rule, environment.update_protection_rule, environment.delete in the audit log.