---
title: "GitHub Bypass-request API responses and webhooks include corrected metadata: 2026-10-20 | Harbyn"
description: "GitHub Bypass-request API responses and webhooks include corrected metadata, announced Oct 20, 2026."
canonical: "https://harbyn.com/changes/github/2026-10-20-updates-to-github-secret-scanning-4"
last-updated: 2026-10-25
---

# GitHub Bypass-request API responses and webhooks include corrected metadata

Markdown version of <https://harbyn.com/changes/github/2026-10-20-updates-to-github-secret-scanning-4>.

Behavior change - GitHub. low severity. In effect.

Fixed empty secret-type and location details in bypass-request API responses and webhook payloads for command-line pushes when another repository rule ran after secret scanning.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [GitHub](https://harbyn.com/vendors/github.md) |
| Kind | Behavior change |
| Severity | low |
| Status | In effect |
| Announced | Oct 20, 2026 |
| Added to Harbyn | Oct 25, 2026 |
| Lead time | No dated deadline |
| Vendor page | <https://github.blog/changelog/2026-10-20-updates-to-github-secret-scanning> |
| Review | Reviewed by a person, extracted by a model |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses GitHub, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://github.blog/changelog/feed/> (changelog, fetched 2026-10-21 14:31 UTC, sha256 `53b365303c942fee23a6f670d1a1fb27530d96018bd40717a61a78ef7d38d365`)

## Related changes

### More from GitHub

- [Dismissal-request webhooks include request number](https://harbyn.com/changes/github/2026-10-20-updates-to-github-secret-scanning.md) (Behavior change, announced Oct 20, 2026)
- [Custom pattern alerts remain open after matching rescans](https://harbyn.com/changes/github/2026-10-20-updates-to-github-secret-scanning-3.md) (Behavior change, announced Oct 20, 2026)
- [Delegated bypass push and reviewer configuration errors fixed](https://harbyn.com/changes/github/2026-10-20-updates-to-github-secret-scanning-5.md) (Behavior change, announced Oct 20, 2026)
- [Invalid custom pattern API arguments return 422](https://harbyn.com/changes/github/2026-10-20-updates-to-github-secret-scanning-6.md) (Behavior change, announced Oct 20, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: ORDER\_CHANGE notifications add PreFulfillmentStatusChange for Amazon Autos](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-3.md) (effective Oct 28, 2026)
- [BigCommerce: 301 redirects will apply only to storefront channels](https://harbyn.com/changes/bigcommerce/2026-10-07-301-redirects-now-apply-to-storefront-channels-only.md) (effective Nov 10, 2026)
- [Jira / Atlassian Cloud: New IP address ranges in use from January 1, 2027](https://harbyn.com/changes/atlassian-jira/2026-10-16-atlassian-cloud-adds-new-ip-address-ranges.md) (effective Jan 1, 2027)
- [Let's Encrypt: Default certificate lifetime changes to 64 days](https://harbyn.com/changes/letsencrypt/2026-10-07-64-day-certificate-lifetimes-coming-feb-2027.md) (effective Feb 10, 2027)

[All upcoming deadlines](https://harbyn.com/deadlines.md)