Push Protection

Keep Credentials Private

Do not paste passwords, tokens, private keys, secret values, or unredacted output into issues, pull requests, chats, screenshots, or support forms. Share only the repository, affected commit and file path, secret type, and a redacted description with the repository maintainer or organization owner through an existing private channel. Keep GitHub's bypass link private too.

Handle a Real Exposure

Ask the credential owner to revoke or rotate an exposed credential first. Do not change credentials you are not authorized to manage. Keep replacements in the approved secret store, outside Git. Removing text from a file does not revoke access or erase copies that have already left your machine.

Remove It From Every Affected Commit

Use GitHub's blocked-push locations to identify all affected commits. A later commit that deletes the value leaves it in the earlier commits. Review the outgoing range and exact file changes before proceeding.

For your own unpushed work, agree on a focused amendment or interactive rebase that removes the value from each affected commit. Stage only the intended files and check the resulting outgoing range. Preserve unrelated work through an agreed secure recovery procedure; do not copy secret-bearing patches into shared records. Do not reset, stash, clean, rewrite someone else's commits, or force-push shared history as a shortcut.

If the commits were shared or published, coordinate with the repository maintainer before any history change. Cleanup affects collaborators, signatures, and commit references. This guide does not authorize a history rewrite. Follow GitHub's sensitive-data guidance with the responsible maintainer.

Review False Positives and Test Fixtures

Prefer an obvious nonfunctional placeholder. A real credential does not become safe because it is described as a test. If a string is not a secret or is an intentionally nonfunctional fixture, ask the maintainer to review the exact location and reason without copying the value into the discussion.

Use the repository's configured GitHub review or delegated bypass-request route when an exception is appropriate. Do not bypass a block blindly, disable protection, change actors, or use another push method to avoid review. Wait for the required decision. If a request is denied, remove the value before pushing.

Check the Next Push

Complete the agreed remediation and existing checks before trying again. A successful push is not proof that a credential was revoked or that every copy was removed. For GitHub's workflow details, see blocked pushes and bypass review requests.