Skip to main content

비밀 검사 경고 정보

다양한 유형의 비밀 검사 경고에 대해 알아봅니다.

누가 이 기능을 사용할 수 있나요?

리포지토리 소유자, 조직 소유자, 보안 관리자 및 관리자 역할이 있는 사용자

Secret scanning은(는) 다음 리포지토리에 사용할 수 있습니다.

  • GitHub Advanced Security을(를) 지원하는 조직 소유 리포지토리
  • GitHub Advanced Security을(를) 지원하는 엔터프라이즈의 사용자 소유 리포지토리

About types of alerts

There are two types of secret scanning alerts:

  • Secret scanning alerts: Reported to users in the Security tab of the repository, when a supported secret is detected in the repository.
  • Push protection alerts: Reported to users in the Security tab of the repository, when a contributor bypasses push protection.

About secret scanning alerts

When GitHub detects a supported secret in a repository that has secret scanning enabled, a secret scanning alert is generated and displayed in the Security tab of the repository.

secret scanning alerts can be of the following types:

  • High confidence alerts, which relate to supported patterns and specified custom patterns.
  • Other alerts, which can have a higher ratio of false positives or secrets used in tests.

GitHub displays these "other" alerts in a different list to high confidence alerts, making triaging a better experience for users. For more information, see "Viewing and filtering alerts from secret scanning."

If access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.

About push protection alerts

Push protection scans pushes for supported secrets. If push protection detects a supported secret, it will block the push. When a contributor bypasses push protection to push a secret to the repository, a push protection alert is generated and displayed in the Security tab of the repository. To see all push protection alerts for a repository, you must filter by bypassed: true on the alerts page. For more information, see "Viewing and filtering alerts from secret scanning."

If access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.

Note

Older versions of certain tokens may not be supported by push protection as these tokens may generate a higher number of false positives than their most recent version. Push protection may also not apply to legacy tokens. For tokens such as Azure Storage Keys, GitHub only supports recently created tokens, not tokens that match the legacy patterns. For more information about push protection limitations, see "Troubleshooting secret scanning."

Next steps

Further reading