Fix · GitHub and Git

GitHub blocks my push: it found a secret (push protection)

Blocks your workSecurityNot checked against the vendor's current screens

What you may see

The push fails with a message about secrets or repository rule violations
It names a key type such as a token or an API key

Most likely cause

One of the files you are pushing contains something that looks like a real key or password.

Check first (about two minutes)

Read the message: it names the file and the line.
Ask: was this key ever pushed or shared before?

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a patient senior engineer who knows Git and GitHub very well and explains them to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

Menu and button names change over time. If you cannot find a button or page I mention, say so and tell me what to look for instead of guessing.

THE PROBLEM
GitHub blocks my push: it found a secret (push protection)

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
One of the files you are pushing contains something that looks like a real key or password.

DO THESE STEPS, IN THIS ORDER
1. Find the secret named in the message and tell me what service it belongs to. Do not print the secret itself.
2. Move it out of the code into an environment variable (a file like .env that is in .gitignore) and make the code read it from there.
3. Remove it from the unpushed commit(s) (amend or reset --soft) so it is not in any history that leaves my computer.
4. Tell me to treat that key as exposed anyway and to create a new one at the service and revoke the old (see the entry for a key in GitHub).
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The push passes without the block and a search of the project finds no key text.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not use the "allow the secret" bypass.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Find the secret named in the message and tell me what service it belongs to. Do not print the secret itself.
Move it out of the code into an environment variable (a file like .env that is in .gitignore) and make the code read it from there.
Remove it from the unpushed commit(s) (amend or reset --soft) so it is not in any history that leaves my computer.
Tell me to treat that key as exposed anyway and to create a new one at the service and revoke the old (see the entry for a key in GitHub).

Do not do this

Do not paste the secret into chat to ask what it is.
Do not use the "allow the secret" bypass.

Try another entry

GitHub blocks my push: it found a secret (push protection)

What you may see

Most likely cause

Check first (about two minutes)

The fix prompt

Steps

Do not do this

Related

How can we help?