Reviewing requests to bypass push protection

Approve or deny requests from contributors who need to push commits containing secrets to your organization's repositories.

Who can use this feature?

Access requires:

  • Organization views: write access to repositories in the organization
  • Enterprise views: organization owners and security managers

Organizations owned by a GitHub Team account with GitHub Secret Protection, or owned by a GitHub Enterprise account

In this article

Prerequisites

Before you can review bypass requests, delegated bypass must be enabled for your organization or repositories. See Enabling delegated bypass for push protection.

You can review and manage these requests in security overview.

Reviewing bypass requests for an organization

  1. On GitHub, navigate to the main page of the organization.

  2. Under your organization name, click Security.

    Screenshot of the horizontal navigation bar for an organization. A tab, labeled with a shield icon and "Security," is outlined in dark orange.

  3. In the sidebar, under "Requests", click Push protection bypass.

  4. Select the All statuses dropdown menu, then click Open to view requests that are awaiting review, or that have been approved but for which the commits haven't been pushed to the repository yet.

  5. Click the request that you want to review.

  6. Review the details of the request.

  7. Optionally, add a review comment. The comment will be added to the review request timeline and the secret scanning alert timeline. For example, you may wish to explain the reason for the approval or denial of the request for auditing and reporting reasons, and suggest next steps for the contributor to take.

  8. To allow the contributor to push the commit containing the secret, click Approve bypass request. Or, to require the contributor to remove the secret from the commit, click Deny bypass request.

Filtering requests

You can filter requests by repository, approver (member who has reviewed the request), requester (contributor making the request), timeframe, and status.

Filtering by status

The following statuses are assigned to a request:

StatusDescription
ApprovedThe request has been approved, but the commit(s) have not yet been pushed to the repository.
CancelledThe request has been cancelled by the contributor.
CompletedThe request has been approved and the commit(s) have been pushed to the repository, or the request was rejected.
DeniedThe request has been reviewed and denied.
ExpiredThe request has expired. Requests are valid for 7 days.
OpenThe request has not yet been reviewed.

Further reading