GitHub previews merge blocking for pull requests exposing secrets

GitHub announced a repository rule on September 9 that can block merging pull requests introducing secret-scanning alerts. The public preview requires GitHub Secret Protection or Advanced Security. The rule checks scan completion and unresolved alerts introduced by the PR.

For developers, this is a timely reminder: a token can enter an apparently harmless configuration file or example. Spotting it before integration helps, but does not erase the fact that a real credential was exposed somewhere.

Our editorial reading treats the alert as the start of an investigation. Understand what information was included, who could access it and which remediation procedure applies to the service. Deleting a line from a diff should not be confused with invalidating a compromised credential.

The feature also needs configuration and may involve bypass permissions. We did not enable it or verify any account’s eligibility for this story. For a personal project, the useful next step is understanding the current review process and deciding where the protection would add coverage. Good automation makes an error visible and the response traceable; it does not replace responsibility for addressing the cause.

Sources: GitHub. Checked September 10, 2026. Document-based reporting; no hands-on test.