Summary

Branch create and delete operations are ungoverned — all project roles including Reviewer, Reporter, and Guest can create branches and delete any non-default branch regardless of who created it.

Steps to Reproduce

1. Add a user to a project as Guest
2. Log in as that user
3. Navigate to Branches — New Branch button is available
4. Create a branch successfully
5. Delete a branch created by another user successfully

Expected Behavior

• Branch creation: Developer and above only
• Branch deletion: Developer and above, or creator only
• Default branch: protected (working correctly)

Actual Behavior

• Reviewer (umark) created branch bugfix/sso-logout-bug
• Reporter (andrzej) created branch throttle/saml2-release
• Guest (artur) created branch feature/support-openss
• Guest (artur) deleted branches created by other users
• Only default branch (main) is protected from deletion

Severity

High — Guest users can delete any non-default branch including feature branches actively in use by other developers

Time Estimate

3-4 hours (backend @PreAuthorize on branch create/delete endpoints plus frontend button gating)

Affected Components

• Branch create endpoint authorization
• Branch delete endpoint authorization
• Branch list UI (New Branch button, delete icon visibility)