← All keys & policies
Grant·repository
Ruleset bypass actor
Tier 1 · HighManagement
Why Tier 1
Skips every rule the ruleset enforces: required reviews, signed commits, protected tags. That is control over what reaches production.
A role, team or App on a ruleset's bypass list. It can push or merge past the rules that bind everyone else.
Available on: Free (public repositories only), Team, Enterprise Cloud, EMU, Server. Source
Attack path
Rulesets are where required reviews, signed commits and protected release tags live. Whoever is on the bypass list skips all of it, so a stolen bypass account or App token can force-push a default branch or move a release tag. Bypass entries are often added once for a release bot and never removed.
Mitigations
- Keep bypass lists empty or limited to a break-glass team
- Prefer "pull requests only" bypass over "always"
Detect
Alert on repository_ruleset.update, protected_branch.policy_override in the audit log.