That’s fair, and it’s a real limit of measuring GitHub config. If a team runs review or merge gating in a separate tool, or mirrors to GitHub from somewhere that’s their actual source of truth, the scan won’t see it and they’d look unprotected when they aren’t. The finding is really about repos where GitHub is the place the work happens, and even then it’s public repos only. Worth saying plainly so the number isn’t read as more than it is.

Good distinction. If it’s useful, GitHub lets you require checks and still grant a bypass for specific people or teams, so the hard rule and the emergency escape hatch can coexist, and the scan reads that as passing. Could be you’ve already weighed that, in which case ignore me.

Right? The part that surprised me was that most of them turn branch protection ON and then don’t require any check to pass. So the gate is there, it just doesn’t gate anything. Makes me wonder if private repos are the same or if the public ones just get less attention.