GitHub Advanced Security: Introducing security overview beta and general availability of secret scanning for private repositories

Security Overview Beta Centralizes GitHub Alert Management

Application security teams and development leaders responsible for large numbers of repositories now have a dedicated space to assess their organization's security posture. The new security overview beta, available on the Security tab of organizations and teams, aggregates findings from code scanning, Dependabot, and secret scanning into a single, filterable view.

Administrators can see at a glance which security features are active across repos, what alerts those features have generated, and where coverage gaps exist. Each repository is assigned a risk category based on the count and severity of active alerts, giving clear prioritization guidance for remediation efforts. This feature is included with GitHub Advanced Security.

Flexible filtering enables users to narrow their focus to specific subsets of repositories. For instance, teams can quickly isolate high-risk public repositories that have Dependabot alerts, or limit the view to repos under their direct responsibility.

The drill-down view shows each repository's risk level, which security features are enabled, and the number of active alerts. From there, it's straightforward to navigate to an individual repository to enable a feature or inspect alert details. Recognizing that developers and managers need equivalent visibility for the code they own, GitHub also exposes these insights on the Security tab of a team, as long as the organization uses teams for repository access management.

Secret Scanning for Private Repositories Reaches GA

GitHub Advanced Security's secret scanning for private repositories has left beta. Since the limited beta launched in May 2020, GitHub has broadened the service's pattern coverage to recognize tokens from more than 35 partners, added an API as well as webhooks for alert management, and extended notifications to commit authors—not just administrators—when a secret is committed.

All these capabilities are now available on GitHub Enterprise Cloud and are slated for inclusion in GitHub Enterprise Server 3.1. Since the beta began, the feature has assisted organizations in locating and revoking over 5,000 exposed secrets. Further development is underway, with support for custom patterns on the roadmap.

Documentation for the security overview and secret scanning is available in the GitHub Docs. Both features are components of GitHub Advanced Security, which can be enabled on enterprise accounts.