While Secret Scanning allows users to be notified when secrets were found in code that they pushed to the repository, this notification comes after the secret was already leaked and possibly after others have already pulled the commits that contain the secrets.

From a security standpoint it would be better if an administrator could configure Bitbucket Data Center to reject pushes of commits that contain secrets, i.e. the secret scanning should already happen a push time.