GitSecurityAPI keys

GitHub: Push cannot contain secrets (GH013 push protection)

remote: error: GH013: Repository rule violations found for refs/heads/main. — Push cannot contain secrets

In short: GitHub found an API key or token in your commits and blocked the push. Good: it stopped a leak.

Why it happens

A key ended up in a committed file: often .env committed before .gitignore existed, or a key pasted directly into code. Removing it in a new commit isn't enough because it's still in the earlier commit.

How to fix it

1. Rotate the key with the provider anyway, since it has been on your disk and possibly in other places.
2. Add .env* to .gitignore and stop tracking it: git rm --cached .env.
3. If the secret is only in unpushed commits, rewrite them (e.g. git reset --soft origin/main, then commit again without the file). The push output lists the exact commit and file.
4. Move the key to an env var and read it from process.env.

Copy-paste fix prompt

I'm getting this error in my app:

remote: error: GH013: Repository rule violations found for refs/heads/main. — Push cannot contain secrets

[Paste the full error, stack trace, and the file it points to here]

Likely cause: GitHub found an API key or token in your commits and blocked the push. Good: it stopped a leak.

Task: Find every hard-coded secret in the repo and in unpushed commits, move them to env vars, update .gitignore, and give me the exact git commands to remove them from unpushed history. List the keys I must rotate.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Cursor, Claude Code, Codex, Replit. Last reviewed 2026-11-13.