This update covers improvements and bug fixes for GitHub secret scanning.

Update to audit log events

On November 12, 2026, the business field in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events will change from the enterprise display name to the enterprise slug.

To avoid disruption to any automated workflows, you should update integrations that filter by display name before rollout to accept both formats or use business_id instead. The business field remains a string. Event names and numeric business_id values are unchanged.

Recent improvements and bug fixes

  • Custom pattern alerts: Existing open alerts stay open when a rescan finds that they still match an edited custom pattern, rather than being closed and reopened.
  • Base64-encoded GitHub tokens: In private and internal repositories on github.com with secret scanning enabled, the existing revocation action (public preview) now supports encoded personal access tokens (classic), fine-grained personal access tokens, OAuth access tokens, and GitHub App user access tokens. GitHub automatically decodes the value.
  • Dismissal-request webhooks: Payloads now include exemption_request.number, the repository-scoped request number also available in the REST API. Use the repository and request number together to correlate requests across integrations.
  • Accessibility: The Request pending status on an alert is now keyboard-focusable without activating an action. The revocation flow announces progress to screen readers and moves focus to its completion panel when that panel appears.
  • Bypass-request metadata: Fixed empty secret-type and location details in bypass-request API responses and webhook payloads for command-line pushes when another repository rule ran after secret scanning.
  • Delegated bypass: Fixed push failures caused by existing organization-role entries in reviewer lists, and 500 errors when setting valid reviewer configurations for organization-owned repositories through the REST API.
  • Custom pattern API: Requests rejected by the scanning service for invalid arguments now return 422 instead of 500, so your integration can distinguish these input errors from server failures.

Learn more

Learn more about enterprise audit log events and the secret scanning REST API. Share your feedback in GitHub Community.