push protection bypass requires approval error
Fixes the push-protection bypass approval flow when a push needs an exception. Use when the bypass request requires approver sign-off. Not for removing the secret instead.
TL;DR
Your org requires approval to bypass push protection. Open the bypass request from the blocked-push dialog, explain why the flagged string is safe (or rotate the real secret first), and wait for an approver - do not try to work around the gate.
Error
remote: error: GH013: Push cannot contain secrets - bypass requires approval from a repository administrator.Steps
- In the blocked-push dialog (or the security alert), choose to request a bypass. Expected: a bypass request is created.
- Write a clear justification: what the flagged string is, why it is safe, or confirm the real secret was rotated. Expected: the approver can decide without chasing you.
- Wait for approval, then push again within the approval window. Expected: the push succeeds.
- If approval is denied, remove the secret from the commits instead - the gate is telling you the finding is real.
When to use
- Push protection blocks the push and the org requires bypass approval.
- The flagged string is a false positive or the secret is already rotated.
When not to use
- The secret is real and unrotated - rotate and remove it; do not request a bypass.
- Your org allows self-bypass; then no approval step exists.
Tool compatibility
- GitHub secret scanning with delegated bypass enabled.
- Org/repo admin approvers.
Variant phrasings
Bypass approved but push still blocked
Approvals expire; request again and push promptly.
Need bypasses often for fixtures
Ask admins to add the fixture pattern to the allowlist instead.
Why it happens
Delegated bypass keeps a human in the loop for exceptions to secret blocking. The approval requirement exists so that bypasses are reviewed, not so that developers route around the protection.
Edge cases
- A bypass approval does not mark the string safe forever; repeated pushes of the same pattern need an allowlist entry.
- Never request a bypass for a real, unrotated secret - that defeats the entire control.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_DplOjASegGCBDylYUxgwDQ