Vanta has multiple GitHub tests that check certain settings on branches for repositories being scanned. Vanta will currently only check one branch for these tests, and the branch being used will differ depending on what additional setup was completed when integrating GitHub.
To determine which branch Vanta is looking at, you will want to check if a custom "vanta_production_branch_name" property has been set at the organization level. This was an optional step when connecting GitHub.
If the custom property was not set, Vanta will look at the default branch for the repository.
To check this in GitHub:
Navigate to the Settings page for your organization
Select the Custom properties option under the Repository category:
If the custom property is set, Vanta will only look at the specified branch.
While a default value is set at creation of this property, you can update the property per repository by selecting Set Values in GitHub.
If you would rather have Vanta look at the default branch for all repositories, you can delete the Custom property entirely, and Vanta will look at the default branch.
To check this in Vanta:
Navigate to the Application changes reviewed test
Select the Evidence tab
Under Exports, click to download the testRun.csv file
If a productionBranch is listed for the repository, Vanta is only looking at this branch for the test.
If the productionBranch cell is empty, Vanta is looking at the defaultBranch.
Removing the custom "vanta_production_branch_name" property in GitHub will allow the test to look at the defaultBranch value instead.