Ensure Source Code Management (SCM) email notifications are restricted to verified domains

HighLevel 1Manual reviewsupply-chain

Description

Restrict the organization’s Source Code Management (SCM) email notifications to approved domains only. Restricting Source Code Management email notifications to verified domains only prevents data leaks, as personal emails and custom domains are more prone to account takeover via DNS hijacking or password breach. Note Only members with approved email would be able to receive Source Code Management notifications.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Ensure Source Code Management email notifications are restricted to approved domains only.

How it is fixed

Fix method: Guidance or infrastructure patch

Restrict Source Code Management email notifications to approved domains only.

Properties

Operating systems: Any
Tags: devsecopssupply-chain
Reference: CIS Software Supply Chain Security Guide Benchmark v1.0.0 - 1.3.10 Ensure Source Code Management (SCM) email notifications are restricted to verified domains