Summary

Security teams need more configurability over who can bypass push protection to balance security and developer productivity effectively. By integrating secret scanning's push protection into repository rulesets, Application Security teams can provide fine-grained control over which users can approve requested bypasses. Developers will have the ability to request approval from authorized users to push a blocked secret.

Intended Outcome

Delegated bypass will ensure that push protection is not accidentally bypassed by developers, and prevent secrets from being leaked in the repository.

How will it work?

The GA of delegated bypass will include experience improvements identified in beta, webhook and API support, and metrics.