Server-side push is a repository write that is performed by the server itself, usually after it processes an API request, pull request action, or automation step. The client may only ask for a higher-level operation, but the platform turns that request into an actual branch update, commit, or ref change on the backend.
This matters because the security boundary shifts from the visible request to the internal write path. If authorization is checked only on the outer route, a token may appear limited while still causing a real repository mutation. Attackers look for these mismatches to reach private branches, trigger workflows, or bypass intended scoping. Defenders should verify permissions against the exact resource being modified, log server-initiated writes separately, and treat any server-side push as a sensitive action that can activate automation.