Skip to main content

비밀 검사에서 경고 평가

경고의 유효성 검사와 같이 경고를 평가하고 수정의 우선 순위를 지정하는 데 도움이 되는 추가 기능에 대해 알아봅니다.

누가 이 기능을 사용할 수 있나요?

People with admin access to a repository can view 비밀 검사 경고 for the repository.

파트너에 대한 비밀 검사 경고은(는) 공용 리포지토리 및 공용 npm 패키지에서 자동으로 실행되어 GitHub에서 비밀이 유출된 것을 서비스 공급자에게 알립니다.

사용자에 대한 비밀 검사 경고은(는) 사용자 소유 퍼블릭 리포지토리에서 무료로 제공됩니다. GitHub Enterprise Cloud를 사용하면서 GitHub Advanced Security 라이선스가 있는 조직은 또한 프라이빗 리포지토리와 내부 리포지토리에서 사용자에 대한 비밀 검사 경고을(를) 사용하도록 설정할 수 있습니다. 또한 사용자에 대한 비밀 검사 경고은(는) 을(를) 사용할 수 있으며GitHub Enterprise Cloud에 대한 사용자 소유 리포지토리의 베타Enterprise Managed Users입니다. 자세한 내용은 "비밀 검사 경고 정보" 및 "GitHub Advanced Security 정보"을 참조하세요.

GitHub Advanced Security을(를) 무료로 사용해 보는 방법에 대한 자세한 내용은 "GitHub Advanced Security의 평가판 설정"을 참조하세요.

About evaluating alerts

There are some additional features that can help you to evaluate alerts in order to better prioritize and manage them. You can:

Checking a secret's validity

Validity checks help you prioritize alerts by telling you which secrets are active or inactive. An active secret is one that could still be exploited, so these alerts should be reviewed and remediated as a priority.

By default, GitHub checks the validity of GitHub tokens and displays the validation status of the token in the alert view.

ValidityStatusResult
Active secretactiveGitHub checked with this secret's provider and found that the secret is active
Possibly active secretunknownGitHub does not support validation checks for this token type yet
Possibly active secretunknownGitHub could not verify this secret
Secret inactiveinactiveYou should make sure no unauthorized access has already occurred

Validity checks for partner patterns is available on all types of repositories on GitHub. To use this feature, you must have a license for GitHub Advanced Security.

For information on how to enable validity checks for partner patterns, see "Enabling validity checks for your repository," and for information on which partner patterns are currently supported, see "Supported secret scanning patterns."

You can use the REST API to retrieve a list of the most recent validation status for each of your tokens. For more information, see "REST API endpoints for secret scanning" in the REST API documentation. You can also use webhooks to be notified of activity relating to a secret scanning alert. For more information, see the secret_scanning_alert event in "Webhook events and payloads."

Asking GitHub Copilot Chat about secret scanning alerts

With a GitHub Copilot Enterprise license, you can ask Copilot Chat for help to better understand security alerts, including secret scanning alerts, in repositories in your organization. For more information, see "Asking GitHub Copilot questions in GitHub.com."

Performing an on-demand validity check

Once you have enabled validity checks for partner patterns for your repository, you can perform an "on-demand" validity check for any supported secret by clicking Verify secret in the alert view. GitHub will send the pattern to the relevant partner and display the validation status of the secret in the alert view.

Screenshot of the UI showing a secret scanning alert. A button, labeled "Verify secret" is highlighted with an orange outline.

Reviewing GitHub token metadata

Note

Metadata for GitHub tokens is currently in public beta and subject to change.

In the view for an active GitHub token alert, you can review certain metadata about the token. This metadata may help you identify the token and decide what remediation steps to take.

Tokens, like personal access token and other credentials, are considered personal information. For more information about using GitHub tokens, see GitHub's Privacy Statement and Acceptable Use Policies.

Screenshot of the UI for a GitHub token, showing the token metadata.

Metadata for GitHub tokens is available for active tokens in any repository with secret scanning enabled. If a token has been revoked or its status cannot be validated, metadata will not be available. GitHub auto-revokes GitHub tokens in public repositories, so metadata for GitHub tokens in public repositories is unlikely to be available. The following metadata is available for active GitHub tokens:

MetadataDescription
Secret nameThe name given to the GitHub token by its creator
Secret ownerThe GitHub handle of the token's owner
Created onDate the token was created
Expired onDate the token expired
Last used onDate the token was last used
AccessWhether the token has organization access

Only people with admin permissions to the repository containing a leaked secret can view security alert details and token metadata for an alert. Enterprise owners can request temporary access to the repository for this purpose. If access is granted, GitHub will notify the owner of the repository containing the leaked secret, report the action in the repository owner and enterprise audit logs, and enable access for 2 hours. For more information, see "Accessing user-owned repositories in your enterprise."

Next steps