7.4. Repository Privacy, Visibility, and Branch Protection
Visibility decides who can even find a repository; branch protection decides what happens once they're inside it — and conflating the two is a common exam trap.
💡 First Principle: A repository's visibility — public, private, or internal — controls who can see it at all: public means anyone, private restricts it to explicitly granted access, and internal (an Enterprise setting) means visible to everyone inside the enterprise but not outside it. Branch protection rules are a completely separate layer that constrains what can happen to a branch regardless of who can see the repository — for example, requiring a pull request with approvals before anything merges to main, even for people with write access.
⚠️ Exam Trap: Making a repository private does not, by itself, enforce good security practice. Branch protection rules, required reviews, and access roles are separate controls that still need to be configured — a private repository with no branch protection still lets anyone with write access push straight to main.
Reflection Question: A private repository has no branch protection rules configured. What's stopping a contributor with write access from pushing an unreviewed change directly to main?
