GitHub Makes Push Protection Default for Public Repos

Secret leakage on public repositories remains a serious problem. In the first eight weeks of 2024 alone, GitHub detected over one million leaked secrets—more than a dozen every minute. To address this, GitHub has started rolling out secret scanning push protection by default for all pushes to public repositories.

Previously, this protection was available as an opt-in feature for all GitHub cloud users. Now, when a supported secret is detected in a push to a public repository, the push is automatically blocked. Developers can either remove the secret from their commits or explicitly bypass the block if they determine the secret is safe. The rollout may take a week or two to reach all accounts; users can check their status and opt in early via their code security and analysis settings.

Why Default-Enabled Protection Matters

Leaked secrets can lead to reputation damage, revenue loss, and legal exposure. GitHub Advanced Security customers already scan more than 95% of pushes to private repositories. Extending this protection by default to public repositories gives the open source community the same baseline level of safety, guarding both code and contributor reputations.

Bypass and Control Options

Users retain full control even with push protection enabled. When a block occurs, there is always the option to bypass it. Those who prefer not to use the feature can disable push protection entirely in their user security settings. GitHub recommends leaving push protection on and making case-by-case exceptions, since the bypass option remains available when needed.

Coverage for Private Repositories

Organizations on GitHub Enterprise can extend similar protections to private repositories by enabling GitHub Advanced Security. That plan includes secret scanning, code scanning, AI-powered autofix suggestions, and other static application security testing (SAST) capabilities as part of a broader DevSecOps platform.

Secret Scanning Scope

GitHub secret scanning currently guards over 200 token types and patterns across more than 180 service providers. According to a 2023 study by North Carolina State University researchers, GitHub boasts the industry’s highest precision and lowest rate of false positives among secret detection tools.