Secret scanning's delegated bypass controls for push protection (public beta) - feedback

[courtneycl]

GitHub Advanced Security customers using secret scanning can now specify which teams or roles have the ability to bypass push protection. This is intended to help reduce bypass rates within organizations that see high levels of live secrets being bypassed and committed into repositories.

This is managed through a new bypass list, where organizations can select which teams or roles are authorized to bypass push protection and act as reviewers for bypass requests. If an individual not included in this list needs to push a commit that is initially blocked, they must submit a bypass request. This request is then reviewed by an authorized individual who can either approve or deny it, determining whether the commit can proceed into the repository.

🗣️ We're looking for your feedback as we're in beta, both from the reviewer side and from the requestor side.

Things like:

• what kind of information about the secret would help the reviewer make a decision on the request?
• what are the challenges reviewers are encountering when tracking requests?
• what questions or uncertainties are developers left with during and after submitting a request?

Thank you very much -- we appreciate you ❤️

---

Learn more about secret scanning | Learn more about push protection

[ebickle]

We've deployed this internally and it's working great.

I have a couple requests though!

• We want to centrally approve push protection bypasses, but right now the bypass requests can only be viewed at the repository level. Could an organizational dashboard/page be created to show all requests for an entire organization?

• I see a secret_scanning_push_protection_request.request action in out log streaming, but no webhook equivalent. We need a webhook for push protection requests - we'd like process the webhooks in our GitHub App and then create items in our team's intake board. Right now we have no way to do that - without the dashboard and webhooks, the requests all just go nowhere unless someone knows who to reach out to.

Thanks!

[courtneycl]

Hi @ebickle! Thanks for trying this out, and for your feedback here.

Both the org-level view for requests and webhooks are coming. They are both part of our requirements for GA, but webhooks will land before the org-level view does.

For

the requests all just go nowhere unless someone knows who to reach out to.

are the reviewers on the bypass list getting emails with the requests?

[ebickle]

Thanks for the info @courtneycl!

I checked into the email alerts and I don't believe that's working at the moment. I had someone try to create an artificial bypass request - I can see the request on the repository's security tab and the associated audit log, but no email yet. We have a team set up rather than individual approvers - maybe that's why?

[ebickle]

I partially take that back. I did receive an email, but it went to the personal (primary) email address on my account rather than the corporate email I had configured specifically for the organization. My suspicion is the bypass request emails aren't honoring the custom routing rules on defined on the https://github.com/settings/notifications/custom_routing page.