The secret scanning REST API now returns additional metadata to help you triage alerts more effectively. The new first_location_detected object provides structured location data for the first detected instance of the secret, without requiring a separate call to the token locations API.

The has_more_locations object indicates whether the same secret appears in multiple locations in the repository, offering a lightweight signal that additional locations exist without returning the full set.

These fields are returned from the following endpoints:

– List secret scanning alerts for a repository
– List secret scanning alerts for an organization
– List secret scanning alerts for an enterprise

Learn more from the secret scanning REST API product documentation.