You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/secret-scanning/protecting-pushes-with-secret-scanning.md
+34-7Lines changed: 34 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -76,13 +76,40 @@ If {% data variables.product.prodname_dotcom %} blocks a secret that you believe
76
76
77
77
If you confirm a secret is real and that you intend to fix it later, you should aim to remediate the secret as soon as possible. For example, you might revoke the secret and remove the secret from the repository's commit history. For more information, see "[Removing sensitive data from a repository](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
78
78
79
-
When you allow a secret to be pushed, an alert is created in the "Security" tab. The alert is closed and no notifications are sent if you specify that the secret is a false positive or used only in tests. If you specify that the secret is real and that you will fix it later, the security alert remains open and notifications are sent to the author of the commit and repository administrators. For more information, see "[Managing alerts from secret scanning](/code-security/secret-scanning/managing-alerts-from-secret-scanning)."
79
+
{% data reusables.secret-scanning.push-protection-allow-secrets-alerts %}
80
80
81
81
1. Visit the URL returned by {% data variables.product.prodname_dotcom %} when your push was blocked.
82
82
83
-
2. Choose the option that best describes why you should be able to push the secret.
84
-
- If the secret is only used in tests and poses no threat, click **It's used in tests**.
85
-
- If the detected string is not a secret, click **It's a false positive**.
86
-
- If the secret is real but you intend to fix it later, click **I'll fix it later**.
87
-
3. Click **Allow me to push this secret**.
88
-
4. Reattempt the push on the command line within three hours. If you have not pushed within three hours, you will need to repeat this process.
83
+
{% data reusables.secret-scanning.push-protection-choose-allow-secret-options %}
84
+
1. Click **Allow me to push this secret**.
85
+
2. Reattempt the push on the command line within three hours. If you have not pushed within three hours, you will need to repeat this process.
86
+
87
+
{% if secret-scanning-push-protection-web-ui %}
88
+
## Using secret scanning as a push protection from the web UI
89
+
90
+
When you use the web UI to attempt to commit a supported secret to a repository or organization with secret scanning as a push protection enabled, {% data variables.product.prodname_dotcom %} will block the commit. You will see a banner at the top of the page with information about the secret's location, and the secret will also be underlined in the file so you can easily find it.
91
+
92
+
93
+
94
+
{% data variables.product.prodname_dotcom %} will only display one detected secret at a time in the web UI. If a particular secret has already been detected in the repository and an alert already exists, {% data variables.product.prodname_dotcom %} will not block that secret.
95
+
96
+
You can remove the secret from the file using the web UI. Once you remove the secret, the banner at the top of the page will change and tell you that you can now commit your changes.
97
+
98
+
99
+
100
+
### Bypassing push protection for a secret
101
+
102
+
If {% data variables.product.prodname_dotcom %} blocks a secret that you believe is safe to push, you can allow the secret and specify the reason why it should be allowed. If you confirm a secret is real and that you intend to fix it later, you should aim to remediate the secret as soon as possible.
103
+
104
+
{% data reusables.secret-scanning.push-protection-allow-secrets-alerts %}
105
+
106
+
If you confirm a secret is real and that you intend to fix it later, you should aim to remediate the secret as soon as possible.
107
+
108
+
1. In the banner that appeared at the top of the page when {% data variables.product.prodname_dotcom %} blocked your commit, click **Bypass protection**.
109
+
{% data reusables.secret-scanning.push-protection-choose-allow-secret-options %}
110
+
111
+
When you allow a secret to be pushed, an alert is created in the "Security" tab. {% data variables.product.prodname_dotcom %} closes the alert and doesn't send a notification if you specify that the secret is a false positive or used only in tests. If you specify that the secret is real and that you will fix it later, {% data variables.product.prodname_dotcom %} keeps the security alert open and sends notifications to the author of the commit, as well as to repository administrators. For more information, see "[Managing alerts from secret scanning](/code-security/secret-scanning/managing-alerts-from-secret-scanning)."
0 commit comments