Say "all" only if the platform enforces it. On GitHub that means branch protection with required approving reviews, required status checks, and the option that stops administrators from bypassing the rules. Without those settings, "all code is reviewed" is a habit, not a control, and a reviewer can ask for a screenshot.
What the questionnaire is really testing
The reviewer wants to know whether one person can push a change to production alone. For a small team, two engineers can still meet a reasonable standard if the rules are enforced by tooling, not by memory.
Settings worth checking
GitHub's protected branch documentation describes these options:
- Required reviews. Set a minimum number of approving reviews. You can dismiss stale approvals when new commits arrive and require approval from someone other than the last person who pushed.
- Status checks. Require checks to pass before merge, optionally requiring the branch to be up to date with its base.
- Code owners. Optionally require approval from the owner of the code a pull request changes.
- Signed commits and linear history. Optional extras.
- Force pushes. Blocked by default.
- Admins. By default, the rules do not apply to administrators or roles with bypass permission. A separate setting applies the rules to them too.
That last point is the one that changes your answer. If admins can bypass, a true statement is "reviews are required for all but repository administrators". Turn on the stricter option, or word your answer to match reality.
Answer patterns
| Your setup | Honest wording |
|---|---|
| Reviews required, admins included, checks required | All changes to the production branch require one approving review and passing checks, enforced by branch protection, including for administrators |
| Reviews required, admins can bypass | Changes require review. Repository administrators can technically bypass, and we limit that role to named people |
| Reviews by convention only | We review changes as a team practice. We are moving to enforced branch protection |
For a two person team, add what happens when one person is away: who approves, and whether an emergency path exists and gets reviewed after the fact.
Evidence to keep
- A screenshot or export of the branch rule settings, dated.
- A sample of recent pull requests showing approvals.
- The list of people with admin or bypass permission.
- Your emergency change procedure, in a paragraph.
Auditors like samples more than assertions. Pick a few recent changes and show the trail.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a failed check blocks the merge until the issue is dealt with.
Safeguard's policies and gates can add security checks to the pull request, and its dependency scanning feeds them. Try the free scan to see what a check would report.
Quick check
Can a two person team claim peer review?
Yes, if the platform requires another person's approval before merge and the rules apply to both of you. Document what happens when one is unavailable.
Do GitHub branch rules apply to admins by default?
According to GitHub's documentation, no. A separate option applies the rules to administrators too.
Sources
- GitHub Docs, About protected branches. Paraphrased.
Last reviewed: 19 October 2026.
