{"id":"5b148225-e856-409d-9af3-4ed47a94f117","task":"Configure GitHub secret scanning push protection and audit bypass requests via REST API","domain":"docs.github.com","steps":["Enable push protection for an organization with PATCH /orgs/{org} and the body field secret_scanning_push_protection_enabled_for_new_repositories set to true, then enable per-repo via PATCH /repos/{owner}/{repo}.","Enable delegated bypass so that developer bypass attempts require reviewer approval: configure this in the organization's Code Security settings or via the API.","Poll pending bypass requests with GET /orgs/{org}/bypass-requests/secret-scanning or GET /repos/{owner}/{repo}/bypass-requests/secret-scanning using a token with security_events write scope.","Approve or deny a bypass request with PATCH on the bypass request endpoint and a body containing status: approved or status: denied.","Set up a webhook on the organization to receive push_protection_bypass event payloads for real-time alerting to your security team.","Review the audit log via GET /orgs/{org}/audit-log with the phrase secret_scanning to capture all push protection and bypass events."],"gotchas":["Delegated bypass is only available on GitHub Enterprise Cloud; GitHub Free and Team plans do not support the approval workflow.","Approving a bypass does not rotate the secret; the security team must still ensure the exposed credential is revoked in the upstream system.","Webhook payloads for push_protection_bypass may arrive slightly after the git push completes; do not rely on them as a synchronous gate."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:37.008Z"},"url":"https://mcp.waymark.network/r/5b148225-e856-409d-9af3-4ed47a94f117"}