## TL;DR

Push protection rejected your push because a commit contains something that looks like a secret. Remove the secret from the commits (rewrite history on the branch), rotate the exposed credential, then push again.

## Error

```text
remote: error: GH013: Repository rule violations found for refs/heads/feature.
remote: - Push cannot contain secrets
```

## Steps

1. Identify the secret value the rejection names the file and the secret type. Expected: you know which commit and file contain it.
2. Rotate the credential immediately  -  assume it is compromised the moment it was committed. Expected: the old value no longer works.
3. Remove it from the branch history: `git rebase -i` to edit the offending commit, or start the branch over if the history is messy. Expected: no commit on the branch contains the secret.
4. Push the rewritten branch. Expected: push protection passes.

## When to use

- GitHub push protection rejects the push with GH013 / 'Push cannot contain secrets'.
- The secret is in commits on your branch.

## When not to use

- You need a bypass approval  -  that is the bypass workflow, not the removal workflow.
- The detection is a false positive on a placeholder; use the 'allow secret' flow in the UI.

## Tool compatibility

- GitHub secret scanning with push protection enabled.
- Git 2.x.

## Variant phrasings

### Secret in an old commit deep in history

Use an interactive rebase or filter-repo to remove it from every commit.

### False positive on a test fixture

Mark it as allowed in the security alert UI instead of rewriting history.

## Why it happens

Push protection scans the pushed commits for secret patterns before accepting them. A rejection means the secret would otherwise land in the repo history, where it is effectively public to anyone with read access.

## Edge cases

- Rewriting history requires force-push; coordinate if others share the branch.
- Rotation is not optional  -  the secret was exposed the moment the commit existed, even if the push was blocked.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jxbjMn3bqwX5dJaYY4ED-g