> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CICD-SEC-1 — Default branch can be deleted

> Branch protection permits deletion of the default branch.

| Field    | Value                                      |
| -------- | ------------------------------------------ |
| Category | `CICD-SEC-1`                               |
| Severity | HIGH                                       |
| Auto-fix | ✓ (via `--fix-settings` or web Fix button) |
| Source   | Repository configuration                   |

## What the check does

Reads the default branch's protection rule and reports when `allow_deletions.enabled` is `true`.

## Why it matters

The default branch should never be deletable. Losing it:

* Destroys the canonical history pointer.
* Breaks every CI workflow, deploy pipeline, and dependent that resolves `main`.
* Removes a recovery anchor — restoring from a fork or local clone introduces ambiguity about which version was canonical.

## How to fix

Settings → Branches → edit the rule for the default branch → uncheck **Allow deletions**.