Profile Applicability:
 Level 1

Description:
Inactive or stale branches in version control repositories should be regularly reviewed and deleted if no longer needed.  This practice helps maintain repository hygiene, reduces clutter, minimizes potential security risks from forgotten code, and simplifies codebase management.

Rationale:
 Removing inactive branches reduces confusion for developers, lowers the risk of outdated or vulnerable code being accidentally merged or deployed, and supports compliance by limiting unnecessary code retention. Regular branch cleanup improves overall repository performance and clarity.

Impact:
 Pros:

  • Enhances repository organization and clarity.

  • Minimizes risk from outdated or unmaintained code.

  • Simplifies repository management and navigation.

  • Supports compliance with data retention policies.

Cons:

  • Requires discipline and periodic effort.

  • Risk of accidental deletion if reviews are not thorough.

Default value:
 Repositories may accumulate inactive branches over time without systematic review or deletion.

Audit:
 Review repository branch lists and logs to identify stale branches. Verify that inactive branches are reviewed and deleted according to organizational policies.

Remediation:
 Establish and enforce branch lifecycle policies, including criteria for inactivity and deletion timelines. Use automation tools or scripts to assist in identifying and cleaning up inactive branches. Communicate policies clearly to development teams.

References:

  1. GitHub Managing Branches: https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/managing-branches-in-your-repository

  2. GitLab Branch Cleanup: https://docs.gitlab.com/ee/user/project/repository/branches/#deleting-branches

  3. CIS Controls v8, Control 6 - Maintenance, Monitoring, and Analysis of Audit Logs: https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/