Secret scanning's delegated bypass controls for push protection (public beta) - feedback

[courtneycl]

GitHub Advanced Security customers using secret scanning can now specify which teams or roles have the ability to bypass push protection. This is intended to help reduce bypass rates within organizations that see high levels of live secrets being bypassed and committed into repositories.

This is managed through a new bypass list, where organizations can select which teams or roles are authorized to bypass push protection and act as reviewers for bypass requests. If an individual not included in this list needs to push a commit that is initially blocked, they must submit a bypass request. This request is then reviewed by an authorized individual who can either approve or deny it, determining whether the commit can proceed into the repository.

🗣️ We're looking for your feedback as we're in beta, both from the reviewer side and from the requestor side.

Things like:

• what kind of information about the secret would help the reviewer make a decision on the request?
• what are the challenges reviewers are encountering when tracking requests?
• what questions or uncertainties are developers left with during and after submitting a request?

Thank you very much -- we appreciate you ❤️

---

Learn more about secret scanning | Learn more about push protection