This repository relies on GitHub Secret Scanning and Push Protection to prevent accidental leaks of credentials, API keys, and other sensitive information.
If Push Protection blocks a commit due to a suspected secret that is actually a false positive (e.g., dummy test data or a non-sensitive string resembling a token), maintainers and contributors can unblock the push by following these steps:
- Review the Block: When a push is blocked, the Git output will display a message with a link to GitHub.
- Navigate to the Link: Open the provided link in your web browser to view the detected secret.
- Select Bypass Reason: If you have confirmed it is a false positive, select the appropriate reason from the dropdown (e.g., "False positive", "Used in tests", or "Will fix later").
- Confirm the Bypass: Submit the form to bypass the protection for this specific secret.
- Re-push: Run your
git pushcommand again. It will now succeed.
Important:
- Bypasses are audited. Maintainers periodically review bypass logs.
- Never bypass push protection for a real secret. If a real secret is detected, remove it from your commit history before pushing. If it was already exposed, it must be rotated immediately.