Configuring notifications for secret scanning alerts
In addition to displaying an alert in the Security tab of the repository, GitHub can also send email notifications for alerts. These notifications are different for incremental scans and historical scans.
Incremental scans
When a new secret is detected, GitHub notifies all users with access to security alerts for the repository according to their notification preferences. These users include:
- Repository administrators
- Security managers
- Users with custom roles with read/write access
- Organization owners and enterprise owners, if they are administrators of repositories where secrets were leaked
Note
Commit authors who've accidentally committed secrets will be notified, regardless of their notification preferences.
You will receive an email notification if:
- You are watching the repository.
- You have enabled notifications for "All Activity", or for custom "Security alerts" on the repository.
- In your notification settings, under "Subscriptions", then under "Watching", you have selected to receive notifications by email.
-
On GitHub, navigate to the main page of the repository.
-
To start watching the repository, select Watch.
-
In the dropdown menu, click All Activity. Alternatively, to only subscribe to security alerts, click Custom, then click Security alerts.
-
Navigate to the notification settings for your personal account. These are available at https://github.com/settings/notifications.
-
On your notification settings page, under "Subscriptions", then under "Watching", select the Notify me dropdown.
-
Select "Email" as a notification option, then click Save.
For more information about setting up notification preferences, see "Managing security and analysis settings for your repository" and "Configuring your watch settings for an individual repository."
Historical scans
For historical scans, GitHub notifies the following users:
- Organization owners, enterprise owners, and security managers—whenever a historical scan is complete, even if no secrets are found.
- Repository administrators, security managers, and users with custom roles with read/write access—whenever a historical scan detects a secret, and according to their notification preferences.
We do not notify commit authors.
For more information about setting up notification preferences, see "Managing security and analysis settings for your repository" and "Configuring your watch settings for an individual repository."
Auditing responses to secret scanning alerts
You can audit the actions taken in response to secret scanning alerts using GitHub tools. For more information, see "Auditing security alerts."