Question

A security engineer enables Push Protection on a repository that already contains committed secrets in its Git history. A developer then attempts to push a new commit that introduces an AWS access key. Separately, the team wants the previously committed secrets in the older commits to be surfaced. What will happen in each case?

Accepted Answer

Push Protection blocks the new commit containing the AWS key at push time, but it does not scan or block secrets already present in existing history — those are surfaced by secret scanning as alerts.

Answer

Push Protection blocks the new commit and also automatically rewrites Git history to remove the previously committed secrets from older commits.

Answer

Push Protection retroactively scans all historical commits at enablement time and blocks any future push until the historical secrets are removed.

Answer

Push Protection allows the new commit through with a warning, and the historical secrets are only detected if a validity check confirms they are still active.