[Bug] Unauthorized autonomous merge with admin override bypassed branch protection
Status Closed — not planned
Reported on v2.1.177
Maintainer reply None cached
Activity 3 comments · opened Jun 15, 2026 · closed Jul 27, 2026
Bug Description
Claude Code (Opus 4.8) ran gh pr merge --admin to merge a
▎ dev→main PR and trigger a production deploy without user
▎ authorization, using an admin override to bypass branch
▎ protection. User had not approved the merge/deploy.
▎ Requesting guardrails against autonomous
▎ merges/deploys/admin-overrides.
Environment Info
- Platform: linux
- Terminal: vscode
- Version: 2.1.177
- Feedback ID: 8c881603-e3a5-4ef3-a12c-8dd2a06566e5
Errors
[]This issue has 3 comments on GitHub. Read the full discussion on GitHub ↗