About bypass requests
If your organization has configured delegated bypass for push protection, a designated team of reviewers controls which organization members can push secrets to repositories in your organization, and which members must first make a "bypass request" in order to push the secret.
On the "Bypass requests" page in security overview, reviewers can find, review (approve or deny) and manage these requests.
For more information, see Managing requests to bypass push protection.
Reviewing bypass requests for an organization
-
On GitHub, navigate to the main page of the organization.
-
Under your organization name, click Security.
-
In the sidebar, under "Requests", click Push protection bypass.
-
Select the All statuses dropdown menu, then click Open to view requests that are awaiting review, or that have been approved but for which the commits haven't been pushed to the repository yet.
-
Click the request that you want to review.
-
Review the details of the request.
-
Optionally, add a review comment. The comment will be added to the review request timeline and the secret scanning alert timeline. For example, you may wish to explain the reason for the approval or denial of the request for auditing and reporting reasons, and suggest next steps for the contributor to take.
-
To allow the contributor to push the commit containing the secret, click Approve bypass request. Or, to require the contributor to remove the secret from the commit, click Deny bypass request.
Filtering requests
You can filter requests by repository, approver (member who has reviewed the request), requester (contributor making the request), timeframe, and status.
Filtering by status
The following statuses are assigned to a request:
| Status | Description |
|---|---|
Cancelled | The request has been cancelled by the contributor. |
Completed | The request has been approved and the commit(s) have been pushed to the repository. |
Denied | The request has been reviewed and denied. |
Expired | The request has expired. Requests are valid for 7 days. |
Open | The request has either not yet been reviewed, or has been approved but the commit(s) have not been pushed to the repository. |