## TL;DR

Your org requires approval to bypass push protection. Open the bypass request from the blocked-push dialog, explain why the flagged string is safe (or rotate the real secret first), and wait for an approver  -  do not try to work around the gate.

## Error

```text
remote: error: GH013: Push cannot contain secrets  -  bypass requires approval from a repository administrator.
```

## Steps

1. In the blocked-push dialog (or the security alert), choose to request a bypass. Expected: a bypass request is created.
2. Write a clear justification: what the flagged string is, why it is safe, or confirm the real secret was rotated. Expected: the approver can decide without chasing you.
3. Wait for approval, then push again within the approval window. Expected: the push succeeds.
4. If approval is denied, remove the secret from the commits instead  -  the gate is telling you the finding is real.

## When to use

- Push protection blocks the push and the org requires bypass approval.
- The flagged string is a false positive or the secret is already rotated.

## When not to use

- The secret is real and unrotated  -  rotate and remove it; do not request a bypass.
- Your org allows self-bypass; then no approval step exists.

## Tool compatibility

- GitHub secret scanning with delegated bypass enabled.
- Org/repo admin approvers.

## Variant phrasings

### Bypass approved but push still blocked

Approvals expire; request again and push promptly.

### Need bypasses often for fixtures

Ask admins to add the fixture pattern to the allowlist instead.

## Why it happens

Delegated bypass keeps a human in the loop for exceptions to secret blocking. The approval requirement exists so that bypasses are reviewed, not so that developers route around the protection.

## Edge cases

- A bypass approval does not mark the string safe forever; repeated pushes of the same pattern need an allowlist entry.
- Never request a bypass for a real, unrotated secret  -  that defeats the entire control.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DplOjASegGCBDylYUxgwDQ