# GitHub branch protection bypass can expose protected credentials to workflows

DevFeed: [GitHub branch protection bypass can expose protected credentials to workflows](<https://devfeed.tech/articles/working-as-unexpected-13341.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/working-as-unexpected>)

Published: 2024-05-31T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [code productivity](<https://devfeed.tech/topics/code-productivity.md>)

Tags: [branch-protection-rules](<https://devfeed.tech/tags/branch-protection-rules.md>), [github](<https://devfeed.tech/tags/github.md>), [github-branch-protections](<https://devfeed.tech/tags/github-branch-protections.md>), [new-branches](<https://devfeed.tech/tags/new-branches.md>), [protected-branches](<https://devfeed.tech/tags/protected-branches.md>), [release-branches](<https://devfeed.tech/tags/release-branches.md>), [release-workflow](<https://devfeed.tech/tags/release-workflow.md>), [secret-storage](<https://devfeed.tech/tags/secret-storage.md>), [secret-store](<https://devfeed.tech/tags/secret-store.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [security-best-practices](<https://devfeed.tech/tags/security-best-practices.md>), [use-of-github](<https://devfeed.tech/tags/use-of-github.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [workflows](<https://devfeed.tech/tags/workflows.md>)

## AI overview

The article describes a GitHub branch protection behavior that can allow a newly created branch to become protected and gain access to environment secrets through workflows. The author argues that this behavior can enable credential exfiltration and create risks for projects using wildcard branch protection rules, particularly release workflows.

## Source excerpt

Don't let the unexpected derail your projects. Read our guide on embracing uncertainty in software development and unlock new possibilities.