CICD-SEC-1 — Default branch can be deleted

Branch protection permits deletion of the default branch.

Field	Value
Category	CICD-SEC-1
Severity	HIGH
Auto-fix	✓ (via --fix-settings or web Fix button)
Source	Repository configuration

What the check does

Reads the default branch’s protection rule and reports when allow_deletions.enabled is true.

Why it matters

The default branch should never be deletable. Losing it:

• Destroys the canonical history pointer.
• Breaks every CI workflow, deploy pipeline, and dependent that resolves main.
• Removes a recovery anchor — restoring from a fork or local clone introduces ambiguity about which version was canonical.

How to fix

Settings → Branches → edit the rule for the default branch → uncheck Allow deletions.