GitHub now records who actually pushed each commit, and can block committer spoofing

Serguey Asael Shinder13 October 2026, 06:542 min read

GitHub announced on 12 October that it now durably records the authenticated user who pushed each commit and shows that pusher identity in the web interface and the API, next to the existing author and committer fields. The feature is in limited public preview for GitHub Enterprise customers, who join by asking their account team.

The problem it addresses. In Git, the author and committer of a commit are plain strings written by the client that creates it. GitHub's changelog spells out the consequence: anyone with write access to a repository can set those fields to any name and email. An attacker who compromises a low-privilege account can therefore push commits that appear to come from a trusted maintainer — which can slip past review policies and muddy audit trails. GitHub has always authenticated the push itself; until now that authenticated identity was not kept with each commit.

What changes. Every commit pushed to a repository now carries a pusher identity that is independent of what the author and committer metadata claim. In addition, a new repository rule condition, "Committer must match pusher", blocks pushes in which the committer metadata does not match any verified email address of the authenticated pusher. GitHub describes this as closing a path for commit identity spoofing.

What it does not change. Author fields can still differ from the pusher — which is normal when someone pushes a colleague's work or a rebased branch. The new rule checks the committer field against the pusher's verified emails; teams that push on behalf of others, or use bots and automation accounts, should check how those flows behave before turning the rule on for every repository.

Why it matters for audits. For incident response the useful part is the record rather than the block: when a malicious commit is found, the question "which account actually put this here" now has an answer stored with the commit itself, instead of one reconstructed from audit logs.

Source: GitHub Changelog, "Push attribution for commits in limited public preview" — https://github.blog/changelog/2026-10-12-push-attribution-public-preview