What does GitHub Secret Scanning's 'push protection' feature do when a secret is detected?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Push protection is the bouncer at the door — it stops secrets before they enter the repository history, not after.
Full explanation below image
Full Explanation
GitHub Secret Scanning with push protection intercepts pushes that contain recognized secret patterns and blocks them from being accepted. The developer must either remove the secret from the commit or explicitly bypass the protection with a justification (which creates an audit log entry). This prevents secrets from entering git history where they're difficult to truly purge even after deletion. Without push protection, secret scanning only alerts after the secret is already in the repository. Push protection covers 100+ secret types from providers like AWS, Google, Azure, Stripe, and more.