Password Authentication For Git Over HTTP(S) Should Not Be Enabled

policy name: password_authentication_enabled_for_git_is_enabled

severity: LOW

Description

Password authentication for Git protocol operations (pull / push) is discouraged in favor of using personal access tokens and keys. From a security standpoint, it is recommended to disable password authentication completely.

Remediation

  1. Press Settings -> General
  2. Expand ‘Sign-in restrictions’ section
  3. Un toggle ‘Allow password authentication for Git over HTTP(S)’
  4. Press ‘Save Changes’