client_paylaod (dispatch), commits (push), head_commit (push) and merge_group are not under external attacker control so remove them