Description:
This control ensures that external collaborators are restricted from directly pushing changes to protected branches within a Bitbucket repository. Direct modifications to protected branches are limited to authorized users and groups, helping protect code integrity and supporting secure development practices.
Rationale:
Restricting push access for external collaborators enforces the principle of least privilege and reduces the risk of unauthorized, accidental, or malicious changes to repository content. This control helps maintain repository security and supports organizational change management requirements.
Impact:
Prevents unauthorized users from directly modifying protected branches.
Reduces the risk of accidental or malicious code changes.
Improves repository security and governance.
Supports compliance requirements related to access control and change management.
Ensures only authorized users can push changes to protected branches.
Default Value:
Disabled by default. Repository administrators must explicitly configure branch restrictions to limit write access to authorized users or groups.
Remediation
Test Plan
Navigate to the target Bitbucket repository.
Review the branch restriction configured for the protected branch.
Verify that Only specific people or groups have write access is configured.
Attempt to push changes directly to the protected branch using an external collaborator account.
Verify that the push attempt is denied.
Verify that the external collaborator is not included in the authorized users or groups list.
If direct pushes are permitted, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to Bitbucket with administrative access to the repository.
Navigate to the target repository.
Click the three-dot menu (⋯) next to the repository name and select Settings.
Under Workflow, select Branch restrictions.
Click Add a branch restriction or edit an existing branch restriction.
Under Select branches, specify the branch name, branch pattern, or branch type to protect.
Select the Branch permissions tab.
Under Write access, select Only specific people or groups have write access.
Add only the authorized users or groups that require direct push access to the protected branch.
Ensure external collaborators are not included in the authorized users or groups list.
Click Save to apply the branch restriction.
Backout Plan:
Sign in to Bitbucket with administrative access to the repository.
Navigate to the target repository.
Click the three-dot menu (⋯) next to the repository name and select Settings.
Under Workflow, select Branch restrictions.
Edit the applicable branch restriction.
Under Write access, modify the authorized users or groups list as required.
Alternatively, select Everyone with access to the repository has write access.
Click Save.
References: