GitHub · Pull requests · Push protection · Checked October 27, 2026

GitHub: a push is blocked by push protection

Push protection is a secret scanning feature that blocks a push containing a supported secret before it reaches the repository. It covers pushes from the command line, commits made in the GitHub UI, file uploads and requests to the REST API (GitHub's push protection, checked October 27, 2026). The branch of a pull request is pushed like any other, so a secret in any commit of the push stops the whole push, and the message lists every commit and path where the secret is.

git push                                         blocked: commit and path of each secret, and a URL
PUT  /repos/OWNER/REPO/contents/PATH             409
POST /repos/OWNER/REPO/git/blobs                 409
POST /repos/OWNER/REPO/secret-scanning/push-protection-bypasses

Where the block comes from

Push protection for repositories: it requires GitHub Secret Protection, is disabled by default, and can be enabled by a repository administrator, an organization owner, a security manager or an enterprise owner. It blocks pushes containing secrets to the repositories it protects, and a bypass creates an alert in the Security and quality tab.
Push protection for users: only on GitHub.com, enabled by default for your account, it stops you from pushing secrets to public repositories. Bypassing it needs no reason and creates no alert, unless push protection is also enabled for the repository.
On the web: creating, editing or uploading files on GitHub is blocked the same way, one detected secret at a time. A secret that already has an alert in the repository is not blocked (GitHub's push protection in the GitHub UI).
The REST API: "Create a blob" and "Create or update file contents" include push protection, and answer 409 when the content of the request includes a supported secret (GitHub's push protection from the REST API).

What to do

Remove the secret from every commit: if your latest commit added it, remove it, run git commit --amend --all and push. If earlier commits have it, find the earliest commit the message lists, start git rebase -i COMMIT-ID~1, change pick to edit for that commit, remove the secret, then git add ., git commit --amend, git rebase --continue and push (GitHub's push protection from the command line).
Bypass it: by default, anyone with write access to the repository can bypass push protection by giving a reason. Open the URL from the blocked push as the same user who pushed (anyone else gets 404), choose It's used in tests, It's a false positive or I'll fix it later, click Allow me to push this secret, and push again within three hours.
The alert it leaves: used in tests and false positive create a closed alert; I'll fix it later creates an open alert. For a ruleset that requires secret scanning alerts to be resolved, see secret scanning alerts.
No option to bypass: the repository uses delegated bypass. Request bypass privileges from the same URL with a comment; reviewers approve or deny it, and the answer comes by email. Requests expire after 7 days. Once approved, you can push those commits and later commits with the same secret.
From the REST API: remove the secret, or call POST /repos/OWNER/REPO/secret-scanning/push-protection-bypasses with a reason (false_positive, used_in_tests or will_fix_later) and the placeholder_id that push protected routes return. The user must be the original author of the committed secret; it answers 403 without enough permissions, and 404 when the placeholder is not found or push protection is disabled (GitHub's create a push protection bypass).
Another kind of block: a push refused for file paths, extensions or sizes is a push ruleset; see push rules.

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, shows a pull request's reviews, checks and conversations next to the diff, and merges it with the methods the target branch allows. It does not push commits or write files, so push protection does not stop it; pushing a branch from the IDE is a Git push, and GitHub's message for a blocked push lists the commits, the paths and the URL to bypass. The review inbox, diffs and conversations are free; approving, commenting, resolving and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.