GitHub force-push to sensitive branch
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when the protocol's primary repository shows a force-push or push to a sensitive branch (main, master, production, or tagged release) from an account that is not on the protocol's known-contributor list, or when a force-push removes commits from the history of a production branch. The signal is generated via GitHub API webhook monitoring on the repository's push events. Category 6 context: repository history manipulation is documented in exit-scam scenarios — Uranium Finance deleted their GitHub post-exploit — and a force-push to production by an unknown actor is a supply-chain compromise signal.
Why it matters
Uranium Finance ($57.2M, 2021) deleted their GitHub repository post-exploit — a retroactive cover-up rather than a pre-exploit signal, but indicative of the pattern. More relevantly, a supply-chain compromise scenario where an attacker gains repository access and force-pushes malicious code to the production branch would be detected by this signal before any on-chain consequence materializes. The XZ Utils supply-chain attack (not DeFi, but the canonical example) demonstrated that months of contribution activity can precede a single malicious commit to a sensitive branch. GitHub monitoring provides an automated mechanism for detecting this class of supply-chain attack.
Green / Yellow / Red
Green is the baseline when all pushes to sensitive branches originate from known contributors with established repository history. Yellow fires when a push to a sensitive branch occurs from a contributor with shorter tenure than the 30-day threshold — flagged for curator review but not immediately red. Red fires when a force-push occurs on a production branch, or when any push to a production branch originates from an account not in the known-contributor list, particularly if combined with no associated PR review.
Common gray cases
Gray applies when the repository is private and push events are not accessible via the monitoring API, or when the protocol does not maintain a public repository and deployments are managed through a closed DevOps pipeline.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect whether the repository shows a force-push or push to a sensitive branch (main, production tag) from a non-protocol account.