Terminal

remote: error: GH013: Repository rule violations found — Push cannot contain secrets

What it means
GitHub scanned the commits you were about to push, spotted a real API key or secret inside a file, and blocked the push to protect your account.
Likely causes
  • A key was pasted into a code file, config file or .env.example instead of .env.local.
  • .env.local wasn't listed in .gitignore when the commit was made.
Prevention
Never put real keys anywhere except .env.local and Vercel's Environment Variables.

Copy for your agent

GitHub blocked my push with `GH013: Push cannot contain secrets`. Never bypass the block: I am revoking the key now. Remove the secret from the file and the unpushed commit, and verify `.gitignore` covers `.env*`.

Full help articleYou committed a secret: revoke, replace, clean up

Last reviewed Nov 8, 2026