Secret Leaks Are Still a Growth Industry
Exposed credentials are among the easiest vulnerabilities to find and the fastest to exploit. The scale of the problem is hard to overstate: more than 39 million secrets were leaked across GitHub in 2024 alone, according to the State of the Octoverse report. Every minute, GitHub's push protection blocks multiple secrets before they land in a repository. Despite that, secret leaks remain one of the most common — and most preventable — causes of security incidents. The faster code gets written, the faster secrets get spilled.
In response, GitHub is restructuring how its security tooling is sold and delivered. The company today announced the next evolution of GitHub Advanced Security, with three major changes:
- Secret Protection and Code Security are now available as standalone products for enterprises.
- The same standalone products are now available as add-ons for GitHub Team organizations.
- A free, organization-wide secret risk assessment is rolling out as a public preview.
Where Leaked Secrets Come From
Secret exposure is rarely the result of malicious intent. Most software relies on API keys, tokens, and credentials that developers handle dozens of times a day, and accidental exposure is common. A surprisingly large share of breaches, however, trace back to developers who deliberately expose a secret — committing, sharing, or storing it in ways that feel convenient in the moment. Developers also tend to underestimate the risk of private exposures, assuming that a secret sitting in a private repo is safe.
Attackers are adept at turning a seemingly low-risk secret into a foothold. A single exposed token can enable lateral movement to more valuable systems. Even without an active threat, persisting a secret in git history leaves you vulnerable to a future mistake — such as inadvertently making a repository public. Verizon's annual data breach report found that accidental mistakes of this kind were more common in 2024 than in any prior year.
What GitHub Is Changing
GitHub launched its secret scanning partnership program several years ago. It has since grown to include hundreds of token issuers — AWS, Google Cloud Platform, Meta, and OpenAI among them — all contributing detectors for their own credential formats. Last year, push protection became the default for public repositories, which has since stopped millions of secrets from entering the open source ecosystem.
The new changes are aimed at removing cost and packaging barriers. Previously, buying secret scanning and push protection meant purchasing the full Advanced Security suite. Now enterprises can buy Secret Protection or Code Security on their own. For smaller teams on the GitHub Team plan, these products are available as add-ons, so organizations no longer need to upgrade to GitHub Enterprise to get the security features they want.
Start by Not Leaking Secrets in the First Place
The simplest way to deal with leaked secrets is to prevent them from ever existing in your repository. Push protection is GitHub's built-in mechanism for this: it scans commits before they are pushed and blocks any that contain known secret patterns. Because the detectors were built with cloud providers through the partnership program, they catch real credentials with a low rate of false positives.
The accuracy claims are notable. According to a 2023 study by researchers at North Carolina State University, GitHub Secret Protection is the only secret scanning tool — proprietary or open source — with a true positive rate above 50% across all findings. GitHub received a precision score of 75%, compared to 46% for the next-best tool. The distinction matters: it's not that GitHub finds fewer secrets, it's that the ones it flags are real, so developers spend less time triaging noise and more time shipping.
Long-lived credentials are among the most dangerous secrets to leak because they can persist unnoticed for months or years, granting attackers extended access. Managing secrets across their full lifecycle is critical. The OWASP Secrets Management Cheat Sheet offers three basic stages:
- Creation: generate secrets securely and follow the principle of least privilege.
- Rotation: rotate secrets regularly, outside of user credentials.
- Revocation: remove access when no longer needed, or immediately when compromised.
Wherever possible, eliminate human interaction with secrets entirely and automate secrets management. You should also deploy continuous monitoring to detect exposures that slip through, so you can react before an attacker does.
Standalone Products, Team Plan Add-Ons
Until now, investing in GitHub's secret scanning and code security meant purchasing a larger suite, which put the tools out of reach for many organizations. The standalone Secret Protection and Code Security products for GitHub Enterprise change that calculus.
The same standalone products are now available as add-ons for GitHub Team organizations. Previously, smaller development teams could not buy GitHub's security features without upgrading to Enterprise. This makes the tools affordable and easy to deploy for organizations of all sizes.
Run a Free Secret Risk Assessment
If you are unsure whether secrets have already leaked in your organization, GitHub is offering a new way to find out. The secret risk assessment is a point-in-time scan that covers all repositories — public, private, internal, and even archived — and it can be run without purchasing anything. It uses the same scanning engine as GitHub's other secret detection tools and reports the exposure landscape across the organization, along with recommended next steps.
To lower the barrier to adoption, no specific secrets are stored or shared as part of the assessment. The public preview is available today for organizations on GitHub Team and Enterprise plans. GitHub is soliciting feedback on the tool — for instance, whether additional guidance on remediation would be useful, or whether the feature should be extended beyond Team and Enterprise. Questions and comments can be posted in the GitHub Community discussion.
Secret leaks are a persistent and growing risk. Push protection, lifecycle management, and regular exposure scanning each address a different part of the problem — and the new packaging makes all of them more accessible.
