GitHub force-push to sensitive branch
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal fires when the protocol's primary repository shows a force-push or push to a sensitive branch (main, master, production, or tagged release) from an account that is not on the protocol's known-contributor list, or when a force-push removes commits from the history of a production branch. The signal is generated via GitHub API webhook monitoring on the repository's push events. Category 6 context: repository history manipulation is documented in exit-scam scenarios — Uranium Finance deleted their GitHub post-exploit — and a force-push to production by an unknown actor is a supply-chain compromise signal.
**Why it matters** Uranium Finance ($57.2M, 2021) deleted their GitHub repository post-exploit — a retroactive cover-up rather than a pre-exploit signal, but indicative of the pattern. More relevantly, a supply-chain compromise scenario where an attacker gains repository access and force-pushes malicious code to the production branch would be detected by this signal before any on-chain consequence materializes. The XZ Utils supply-chain attack (not DeFi, but the canonical example) demonstrated that months of contribution activity can precede a single malicious commit to a sensitive branch. GitHub monitoring provides an automated mechanism for detecting this class of supply-chain attack.
**Green / Yellow / Red** Green is the baseline when all pushes to sensitive branches originate from known contributors with established repository history. Yellow fires when a push to a sensitive branch occurs from a contributor with shorter tenure than the 30-day threshold — flagged for curator review but not immediately red. Red fires when a force-push occurs on a production branch, or when any push to a production branch originates from an account not in the known-contributor list, particularly if combined with no associated PR review.
**Common gray cases** Gray applies when the repository is private and push events are not accessible via the monitoring API, or when the protocol does not maintain a public repository and deployments are managed through a closed DevOps pipeline.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect whether the repository shows a force-push or push to a sensitive branch (main, production tag) from a non-protocol account.