Protect the main branch so changes arrive through a pull request that someone else reviews and that passes automated checks. Block direct pushes and force pushes. For a volunteer repo, that small setup stops most accidents and makes a malicious change harder to slip in.
Why volunteers need it
Volunteer projects have changing contributors, loose trust and little time. One compromised account or one rushed push can put bad code on your public site. Branch protection turns "we hope people are careful" into a rule the platform enforces.
The OpenSSF Scorecard documentation rates the Branch-Protection check as high risk, noting that projects without it are vulnerable to intentional malicious code injection. It defines the check as whether default and release branches are protected with branch protection or repository rules, so that rules such as requiring review or passing status checks apply before changes are accepted.
The minimum setup
- Require a pull request before merging into main.
- Require at least one approval from someone other than the author.
- Require status checks such as tests or a build to pass.
- Block force pushes and branch deletion on main.
- Apply the rules to admins too, where the platform allows it.
Menus differ by platform and plan, so follow your host's current documentation.
What if you have only one maintainer?
Many small projects have a single active person. A review rule that no one can satisfy becomes a rule that gets switched off. Options:
| Situation | Practical approach |
|---|---|
| One maintainer | Keep required checks and no force push; recruit a second reviewer |
| Two or three people | Require one approval from the other person |
| Many drive by contributors | Require approval from a maintainer for every outside change |
Do not weaken the rule to make it convenient. Fix the staffing instead, even if it means asking a friendly peer to review sensitive changes.
Add checks worth requiring
A required check is only useful if it tells you something.
- A build that must succeed.
- Tests for the donation or login paths.
- A dependency check that flags known vulnerable libraries.
Start with one or two. A slow or flaky check teaches people to bypass the process.
Protect the accounts behind the branch
Branch rules do not help if an attacker holds a maintainer's account. Require MFA for everyone with write access, and limit write access to those who need it. See requiring 2FA for a small GitHub organization.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a failing check blocks the merge until it is resolved.
Where Safeguard fits
Safeguard provides policies, gates and guardrails for pull requests, alongside SBOM and dependency scanning. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Does branch protection stop all bad commits?
No. It adds review and checks, but a careless approval or a stolen account can still cause harm. Treat it as one layer.
Is it worth it for a small project?
Yes. It takes minutes to set up and prevents the most common accidental mistakes.
Sources
Last reviewed: 19 October 2026.
