GitHub force-push to sensitive branch
Usual (USD0 / bUSD0 / USUAL)'s assessment for RD-F-108 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Usual's primary contracts repository (usual-dao/pegasus) is PRIVATE on GitHub. Force-push or sensitive-branch push monitoring requires repository access — unavailable for private repos via public monitoring. The 6 public GitHub repos are all integration forks (DefiLlama, Pendle, KyberSwap) with no sensitive protocol core branches. Public-source monitoring of the primary contracts repo is impossible.
Sources #
- GitHubusual-dao — GitHub organizationusual-dao GitHub org — 6 public repos (all integration forks); pegasus repo is privateretrieved 2026-05-17
Methodology #
Detect whether the repository shows a force-push or push to a sensitive branch (main, production tag) from a non-protocol account.
See the full factor methodology and distribution across all protocols →