secret-scanning

GitHub now protects you by scanning public repos for leaked GitHub login credentials. If you accidentally expose your username and password in code or commit metadata, we will automatically reset your password and email you.

We'd like to thank Will Deane, Director and Principal Consultant at ASX Consulting, and Aaron Devaney, Principal Security Consultant at MDSec, for surfacing the threat of exposed passwords and helping us secure all our users via GitHub's Security Bug Bounty program. You can read more from the researchers here.

For more information:

• About secret scanning
• About GitHub Security Bug Bounty

GitHub Advanced Security customers can now dry run custom secret scanning patterns at the organization (and repository) level. Dry runs allow admins to understand a pattern's impact across an organization and hone the pattern before publishing and generating alerts.

Admins can compose a pattern then 'Save and dry run' to retrieve results from their selected repositories. Scan results will appear on screen as they're detected, but admins can leave the page and later come back to their saved pattern's dry run results. Enterprise-level dry runs will follow shortly.

For more information:

• About custom patterns
• About secret scanning

The audit log now includes events associated with secret scanning custom patterns. This data helps GitHub Advanced Security customers understand actions taken on their repository, organization, or enterprise level custom patterns for security and compliance audits.

New events will be added to the audit log when a custom pattern is created, updated, or deleted.

• Learn more about secret scanning
• Reviewing the audit log for your organization

GitHub Advanced Security customers using secret scanning can now opt to receive a webhook each time a secret is detected in a new location. The secret_scanning_alert_location webhook event includes location details, like the commit SHA, and the associated alert for the detection. A location is created for every new file path containing the detected secret.

• Learn more about secret scanning
• Learn more about webhooks

Organizations with GitHub Advanced Security can now prevent secret leaks with secret scanning’s new push protection feature.

For repositories with push protection enabled, GitHub will block any pushes where a high-confidence token is detected. Developers can bypass the block by providing details of why the secret needs to be committed via a web UI.

Push protection scans for tokens that can be detected with a very low false positive rate. If you run a service that issues tokens we’d love to work with you to make them highly identifiable and include them in push protection. We changed the format of GitHub’s own personal access tokens last year with this in mind.

For more information:

• Learn more about secret scanning
• Learn more about protecting secrets on push
• Read our blog post about secret scanning push protection
• Partner with GitHub on secret scanning

GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets, we help protect users from data leaks and fraud associated with exposed data.

We have partnered with Supabase to scan for their API keys, which allow users to update and access database changes. We'll forward the API keys that we find in public repositories to Supabase, who will automatically revoke the detected secrets and notify the affected users.

We continue to welcome new partners for public repository secret scanning. GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets we help protect users from data leaks and fraud associated with exposed data.

We have partnered with Octopus Deploy to scan for access tokens for their cloud-hosted product, Octopus Cloud. Octopus API keys allow users to perform tasks like creating and deploying releases. We'll forward access tokens found in public repositories to Octopus Deploy, who will notify the affected user via email. More information about Octopus Deploy API tokens can be found here.

We continue to welcome new partners for public repo secret scanning. GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

GitHub Advanced Security customers can now scan their public repositories using Advanced Security secret scanning. Like scanning on private repositories, scanning on public repositories can be enabled at the repository, organization, and enterprise levels. Results can be viewed at each level in both the UI and API.

In addition, GitHub continues to scan all public repositories for secrets issued by our secret scanning partners and to send any detections to the relevant partners. Secret detections that overlap between partner patterns and Advanced Security patterns will be sent to the partner and appear in the secret scanning UI.

Learn more about secret scanning for GitHub Advanced Security

GitHub Advanced Security customers can now enable secret scanning for their archived repositories via the UI and API.

For more information:

• About secret scanning
• About archived repositories

GitHub Advanced Security customers can now dry run custom secret scanning patterns at the repository level. Dry runs allow admins to review and hone their patterns before publishing them and generating alerts.

Admins can compose a pattern then 'Save and dry run' to retrieve results from their repository. The scans are fast – typically just a few seconds – but GitHub will also notify admins via email when dry run results are ready. Organization and enterprise-level dry runs will follow shortly.

For more information:

• About custom patterns
• About secret scanning

GitHub Advanced Security customers can now retrieve private repository secret scanning results at the enterprise level via the GitHub REST API. This new endpoint supplements the existing repository-level and organization-level endpoints.

For more information:

• Documentation for the secret scanning REST API
• Documentation for private repository secret scanning

GitHub Advanced Security customers can now use the GitHub REST API to retrieve commit details of secrets detected in private repository scans. Now available on cloud, the new endpoint will surface details of a secret's first detection within a file, including the secret's location and commit SHA.

Learn more about the secret scanning REST API
Learn more about private repository scanning with Advanced Security