GitHub Secret Scanning

What GitHub Secret Scanning is

GitHub Secret Scanning detects exposed credentials so they can be addressed before they are exploited. It scans branches throughout Git history as well as issues, pull requests, discussions, wikis, and secret gists. When it finds a credential leak, GitHub adds an alert to the repository’s Security and quality tab with details about the exposed credential. Push protection can block secrets before they reach code. Organizations can define regular-expression patterns for their own secrets, while generic patterns can find items such as private keys, connection strings, and generic API keys. AI detection can identify unstructured secrets such as passwords. Validity checks may contact the issuing service to determine whether a credential remains active; provider partners may also validate findings or be notified to take action, such as revoking a credential. Scanning is automatic and free for public repositories. Organization-owned private and internal repositories require GitHub Secret Protection on GitHub Team or GitHub Enterprise Cloud.