Push protection moves secret detection earlier
Credential misuse remains a leading cause of breaches, and the scale of modern development makes simple credential hygiene difficult to enforce. GitHub reports it has identified more than 200,000 secrets across thousands of private repositories using secret scanning for GitHub Advanced Security. It also scans partner patterns across all public repositories at no cost. Now, GitHub Advanced Security customers can stop leaks before they happen: secret scanning can check for high-confidence secrets before a git push is accepted.
Push protection embeds secret scanning directly into the developer workflow. To avoid disrupting productivity, it supports only token types that can be detected with high accuracy. GitHub changed the format of its own authentication tokens last year and has worked with other token issuers to drive highly identifiable patterns. The feature launches with support for 69 high-confidence patterns, each with a signal-to-noise ratio developers can trust. In total, GitHub checks for more than 100 different token types.
How blocked pushes are handled
When a developer pushes code containing an identified secret, GitHub blocks the push. Because high-confidence patterns carry a low false-positive rate, security teams can enforce protection without degrading the developer experience. The developer can remove the secret from the code and push again. In rare cases where immediate remediation isn't practical, the developer can proceed by classifying the finding as a false positive, a test case, or a real instance to fix later.
If push protection is bypassed, GitHub generates a closed security alert for secrets identified as test cases or false positives. For instances flagged to resolve later, an open security alert is created so the developer and repository administrator can collaborate. Teams can also use the organization- and enterprise-level security overview to track overall posture, including secret scanning alerts.
Enabling push protection
Organizations with GitHub Advanced Security can enable push protection at the repository or organization level with a single click in the UI or through the API.
Service providers that issue highly identifiable tokens can join the secret scanning partner program to help protect customers from leaks and be included in push protection. More details are available in the documentation on secret scanning and its push protection.
GitHub Advanced Security also includes code scanning and supply chain security capabilities via Dependabot alerts and security updates. Organizations interested in trying it can reach out to a GitHub sales partner.
