참고 항목
사이트 관리자가 먼저 인스턴스에 대해 secret scanning을 사용하도록 설정해야 이 기능을 사용할 수 있습니다. 자세한 내용은 어플라이언스에 대한 비밀 검사 구성을(를) 참조하세요.
엔터프라이즈 소유자가 엔터프라이즈 수준에서 정책을 설정한 경우 secret scanning을(를) 사용하거나 사용하지 않도록 설정하지 못할 수 있습니다. 자세한 내용은 엔터프라이즈에 대한 코드 보안 및 분석을 위한 정책 적용을(를) 참조하세요.
Detection of pattern pairs
Secret scanning will only detect pattern pairs, such as AWS Access Keys and Secrets, if the ID and the secret are found in the same file, and both are pushed to the repository. Pair matching helps reduce false positives since both elements of a pair (the ID and the secret) must be used together to access the provider's resource.
Pairs pushed to different files, or not pushed to the same repository, will not result in alerts. For more information about the supported pattern pairs, see the table in 지원되는 비밀 검사 패턴.
About legacy GitHub tokens
For GitHub tokens, we check the validity of the secret to determine whether the secret is active or inactive. This means that for legacy tokens, secret scanning won't detect a GitHub Enterprise Server personal access token on GitHub Enterprise Cloud. Similarly, a GitHub Enterprise Cloud personal access token won't be found on GitHub Enterprise Server.
Push protection limitations
If push protection did not detect a secret that you think should have been detected, then you should first check that push protection supports the secret type in the list of supported secrets. For further information, see 지원되는 비밀 검사 패턴.
If your secret is in the supported list, there are various reasons why push protection may not detect it.
- Push protection only blocks leaked secrets on a subset of the most identifiable user-alerted patterns. Contributors can trust security defenses when such secrets are blocked as these are the patterns that have the lowest number of false positives.
- The version of your secret may be old. 이전 버전의 특정 토큰은 최신 버전보다 더 많은 가양성(false positive) 수를 생성할 수 있기 때문에 푸시 보호에서 지원되지 않을 수 있습니다. 푸시 보호는 레거시 토큰에도 적용되지 않을 수 있습니다. Azure Storage 키와 같은 토큰의 경우 GitHub은(는) 레거시 패턴과 일치하는 토큰이 아니라 최근에 만든 토큰만 지원합니다.
- The push may be too large, for example, if you're trying to push thousands of large files. A push protection scan may time out and not block a user if the push is too large. GitHub will still scan and create alerts, if needed, after the push.
- If the push results in the detection of over five new secrets, we will only show you the first five (we will always show you a maximum of five secrets at one time).
- If a push contains over 1,000 existing secrets (that is, secrets for which alerts have already been created), push protection will not block the push.
- If you see a bypass request without commit or file path details, it means that push protection ran out of time. The push was too large or the history too complex to locate the commit that introduced the secret.