secret-scanning

GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets, our scans may prevent data leaks and any fraud associated with exposed data.

We have partnered with Typeform to scan for their access tokens and help secure our mutual users. Typeform API tokens allow Typeform users to create forms, retrieve responses, and configure webhooks. More information about Typeform API tokens can be found here.

We’ll forward access tokens found in public repositories to Typeform, who will verify and automatically disable the token. Typeform will then notify the user with the detection details (token name, where it was detected, and the token scopes).

We continue to welcome new partners for public repo secret scanning. GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

GitHub secret scanning helps protect users by searching repositories for known types of secrets. By flagging leaked secrets, our scans can prevent data leaks and prevent the fraudulent use of accidentally committed secrets.

We have partnered with Meta to scan for their access tokens and help keep our mutual users secure. Our scan currently covers Facebook user access tokens and page access tokens. These tokens provide permissions to APIs that read, write, or modify the data belonging to a Facebook user or page.

We'll forward access tokens found in public repositories to Meta. Meta will then automatically invalidate tokens that have a valid session and notify app developers.

We continue to welcome new partners for public repo secret scanning. GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

GitHub secret scanning helps protect users by searching repositories for known types of secrets. By flagging leaked secrets, our scans can prevent data leaks and prevent the fraudulent use of accidentally committed secrets.

When enabled on private repositories, GitHub secret scanning raises alerts directly to users. The quality of this experience depends on the quality of the patterns we scan for, which we are constantly refining. In line with that, we are removing our pattern for Azure SQL connection strings from our default pattern set on private repositories.

Advanced Security customers can replicate our previous pattern for Azure SQL connection strings using custom patterns with the following regex:
(?i)[a-z][a-z0-9-]+\.database(?:\.secure)?\.(?:(?:windows|usgovcloudapi)\.net|chinacloudapi\.cn|cloudapi\.de)

We intend to introduce a more general pattern for database connection strings, with a lower false positive rate, in the near future.

Check out our docs for more information on the 100+ patterns that we scan for.

• Learn more about secret scanning
• Learn more about custom patterns
• Partner with GitHub on secret scanning

GitHub Secret Scanning helps protect users by searching repositories for known types of secrets. By flagging leaked secrets, our scans can prevent data leaks and fraudulent uses of secrets that were committed accidentally.

Checkout.com is a cloud-based global payments platform that empowers brands like Adidas, Samsung, and Wise with digital payments built for speed and scale. Checkout.com alerts customers and their account managers of any suspected credential compromise based on notifications from GitHub.

FullStory's Digital Experience Intelligence platform helps companies answer questions about their digital experience by transforming digital interactions across websites and mobile apps into actionable metrics. If a token is exposed, FullStory will notify the developer at risk. For more information on protecting and rotating your FullStory tokens, please refer to their documentation.

We partnered with Checkout.com and FullStory to scan for their API tokens to help keep all of our mutual developers and customers secure. We continue to welcome new partners for public repo secret scanning. In addition, GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

GitHub Secret Scanning scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally. This protects users from fraud and data leaks.

Contributed Systems provides open source and commercial background job systems (Sidekiq and Faktory) for business applications written in a variety of programming languages, including Ruby, Go, Python, and JavaScript. If your Contributed Systems credentials are committed to a public repository, we'll send those matches to them and they'll reach out to you directly.

We continue to welcome new partners for public repo secret scanning. In addition, GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

GitHub Secret Scanning scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally. This protects users from fraud and data leaks.

PlanetScale is a MySQL compatible, serverless database platform built for developers with horizontal scaling, unlimited connections and an elegant GitHub-style workflow. We partnered with PlanetScale to help keep our customers secure by scanning for their developer tokens.

We continue to welcome new partners for public repo secret scanning. In addition, GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

GitHub Secret Scanning scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally. This protects users from fraud and data leaks.

GitHub has partnered with Linear and Ionic to scan for their developer tokens! They are just the latest GitHub secret scanning integrators – since 2018 GitHub has collaborated with 36 token issuers to help keep their customers secure. We continue to welcome new partners for public repo secret scanning. In addition, GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

If you commit a secret to a public repository, the whole world can see it. GitHub secret scanning helps protect you from fraud and data breaches by scanning for leaked API tokens and, via our partners, automatically notifying you and/or revoking them.

From today, GitHub will scan every commit to a public repository for exposed RubyGems, Adobe and OpenAI API keys. We will forward any keys we find to the relevant service, who will automatically disable them and notify their owners. The end-to-end process takes just a few seconds.

RubyGems, Adobe and OpenAI are just the latest GitHub secret scanning integrators – since 2018 GitHub has collaborated with 36 token issuers to help keep their customers secure. We continue to welcome new partners for public repo secret scanning. In addition, GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

• Learn more about secret scanning
• Partner with GitHub on secret scanning

Secret scanning for private repositories is now generally available for all GitHub Advanced Security customers on GitHub Enterprise Cloud. Since announcing the beta last year, we've:

• Expanded our pattern coverage from 24 partners to 37
• Added an API and webhooks
• Added notifications for commit authors when they commit secrets
• Updated the index view to made it easy to triage secrets in bulk
• Reduced the false positive rate on many patterns

We have lots more improvements planned for secret scanning, including support for custom patterns in June.

Learn more about secret scanning
Learn more about GitHub Advanced Security