Skip to main content

Keeping secrets secure with secret scanning

Let GitHub do the hard work of ensuring that tokens, private keys, and other code secrets are not exposed in your repository.

Who can use this feature?

Secret scanning alerts for partners runs automatically on public repositories and public npm packages to notify service providers about leaked secrets on GitHub.

Secret scanning alerts for users are available for user-owned public repositories for free. Organizations using GitHub Enterprise Cloud with a license for GitHub Advanced Security can also enable secret scanning alerts for users on their private and internal repositories. Additionally, secret scanning alerts for users are available and in beta on user-owned repositories for GitHub Enterprise Cloud with Enterprise Managed Users. For more information, see "About secret scanning" and "About GitHub Advanced Security."

For information about how you can try GitHub Advanced Security for free, see "Setting up a trial of GitHub Advanced Security."

About secret scanning

GitHub Enterprise Cloud scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally.

Secret scanning partner program

As a service provider, you can partner with GitHub to have your secret token formats secured through secret scanning, which searches for accidental commits of your secret format and can be sent to a service provider's verify endpoint.

Configuring secret scanning for your repositories

You can configure how GitHub scans your repositories for leaked secrets and generates alerts.

Defining custom patterns for secret scanning

You can define your own custom patterns to extend the capabilities of secret scanning by generating one or more regular expressions.

About the regular expression generator for custom patterns

You can define your own custom patterns to extend the capabilities of secret scanning by generating one or more regular expressions for each pattern, using the regular expression generator.

Generating regular expressions for custom patterns with AI

You can use the regular expression generator to generate regular expressions for custom patterns. The generator uses an AI model to generate expressions that match your input, and optionally example strings.

Managing alerts from secret scanning

You can view, evaluate and resolve alerts for secrets checked in to your repository.

Secret scanning patterns

Lists of supported secrets and the partners that GitHub works with to prevent fraudulent use of secrets that were committed accidentally.

About the detection of generic secrets with secret scanning

Learn how secret scanning uses AI to scan and create alerts for unstructured secrets, such as passwords.

Enabling AI-powered generic secret detection

You can enable AI-powered generic secret detection for your repository. Alerts for generic secrets, such as passwords, are displayed in a separate list on the secret scanning alerts page.

Push protection for repositories and organizations

With push protection for repositories and organizations, secret scanning blocks contributors from pushing secrets to a repository and generates an alert whenever a contributor bypasses the block.

Push protection for users

With push protection for users, you are automatically protected on all pushes to public repositories across GitHub Enterprise Cloud.

Working with push protection

Push protection proactively secures you against leaked secrets in your repositories by blocking pushes containing secrets. To push a commit containing a secret, you must specify a reason for bypassing the block, or, if required, request bypass privileges to bypass the block.

Pushing a branch blocked by push protection

Push protection proactively protects you against leaked secrets in your repositories. You can resolve blocked pushes and, once the detected secret is removed, you can push changes to your working branch from the command line or the web UI.

Troubleshooting secret scanning

If you have problems with secret scanning, you can use these tips to help resolve issues.