Secret Scanning Alerts Now Free for Public Repositories
Credential leaks remain one of the most common entry points for data breaches, yet many organizations still struggle to detect exposed secrets in their code before attackers do. According to IBM’s “Cost of a Data Breach 2022” report, identifying such breaches takes an average of 327 days—time that can translate into significant financial and reputational damage.
GitHub has been tackling this problem through its secret scanning partner program, which scans public repositories for more than 200 token formats and notifies relevant service providers when potential leaks are found. In 2022 alone, the platform alerted partners to over 1.7 million potentially exposed secrets. While that partner notification loop remains in place for fastest protection, GitHub is now extending secret scanning alerts directly to all repository owners on free public repositories.
This change means developers are no longer solely dependent on third-party partners to learn about leaked credentials. With secret scanning alerts, you’ll be notified directly when a secret appears in your code, including cases where no partner can be notified—for example, if the keys to a self-hosted HashiCorp Vault are exposed. The centralized alert list lets you track every detection, drill down into the source of the leak, and audit any remediation actions taken.
With secret scanning we found a ton of important things to address. On the AppSec side, it’s often the best way for us to get visibility into issues in the code.
Enabling and Using Alerts
The gradual public beta rollout begins today, with GitHub expecting all users to have access by the end of January 2023. Those who want earlier access or need to provide feedback can submit a request in the code security discussion forum.
Once available on a repository, secret scanning alerts can be enabled under Settings > Code security and analysis. Detected secrets will appear in the Security tab of your repository under Secret scanning in the side panel, just below Vulnerability alerts. From there, clicking on any alert reveals the compromised secret, its file location, and suggested steps for remediation.
Full instructions for enabling the feature are available in the secret scanning documentation.
Expanding the Partner Program
Service providers interested in helping protect shared users from credential leaks can join the existing secret scanning partner program. The program currently supports over 100 partners and more than 200 detection patterns. To inquire about participation, email [email protected].
