Verified live via the GitHub API — both `main` and `repo` return 404 "not protected." `repo` is the branch operators fetch compiled plugin DLLs from (raw.githubusercontent.com), and it currently accepts direct pushes with no required review.
Combined with the backend's plugin loader having no DLL signature/checksum verification (tracked as SchulyBackend#206), this turns a compromised push or account takeover into a direct RCE pipeline into every operator's backend instance.
Fix: enable branch protection + required review on both `main` and `repo`.
Found during the Aug 2026 security sweep.
Verified live via the GitHub API — both `main` and `repo` return 404 "not protected." `repo` is the branch operators fetch compiled plugin DLLs from (raw.githubusercontent.com), and it currently accepts direct pushes with no required review.
Combined with the backend's plugin loader having no DLL signature/checksum verification (tracked as SchulyBackend#206), this turns a compromised push or account takeover into a direct RCE pipeline into every operator's backend instance.
Fix: enable branch protection + required review on both `main` and `repo`.
Found during the Aug 2026 security sweep.