Note: Your site administrator must enable secret scanning for your GitHub Enterprise Server instance before you can use this feature. For more information, see "Configuring secret scanning for your appliance."
You may not be able to enable or disable secret scanning, if an enterprise owner has set a policy at the enterprise level. For more information, see "Enforcing policies for code security and analysis for your enterprise."
About secret scanning alerts
When secret scanning is enabled, GitHub scans repositories for secrets issued by a large variety of service providers and generates secret scanning alerts.
You can see these alerts on the Security tab of the repository.
If access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.
If you use the REST API for secret scanning, you can use the Secret type
to report on secrets from specific issuers. For more information, see "REST API endpoints for secret scanning."
Note: You can also define custom secret scanning patterns for your repository, organization, or enterprise. For more information, see "Defining custom patterns for secret scanning."
About push protection alerts
Push protection alerts are user alerts that are reported by push protection. Secret scanning as a push protection currently scans repositories for secrets issued by some service providers.
If access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.
Older versions of certain tokens may not be supported by push protection as these tokens may generate a higher number of false positives than their most recent version. Push protection may also not apply to legacy tokens. For tokens such as Azure Storage Keys, GitHub only supports recently created tokens, not tokens that match the legacy patterns. For more information about push protection limitations, see "Troubleshooting secret scanning."
Supported secrets
This table lists the secrets supported by secret scanning. You can see the types of alert that get generated for each token, as well as whether a validity check is performed on the token.
-
Provider—name of the token provider.
-
Secret scanning alert—token for which leaks are reported to users on GitHub. Applies to private repositories where GitHub Advanced Security and secret scanning enabled.
-
Push protection—token for which leaks are reported to users on GitHub. Applies to repositories with secret scanning and push protection enabled.
Note: Older versions of certain tokens may not be supported by push protection as these tokens may generate a higher number of false positives than their most recent version. Push protection may also not apply to legacy tokens. For tokens such as Azure Storage Keys, GitHub only supports recently created tokens, not tokens that match the legacy patterns. For more information about push protection limitations, see "Troubleshooting secret scanning."
-
Validity check—token for which a validity check is implemented. Currently only applies to GitHub tokens.
Provider | Token | Secret scanning alert | Push protection | Validity check |
---|---|---|---|---|
Adafruit | adafruit_io_key | |||
Adobe | adobe_device_token | |||
Adobe | adobe_service_token | |||
Adobe | adobe_short_lived_access_token | |||
Alibaba | alibaba_cloud_access_key_id alibaba_cloud_access_key_secret | |||
Amazon AWS | aws_access_key_id aws_secret_access_key | |||
Asana | asana_personal_access_token | |||
Atlassian | atlassian_api_token | |||
Atlassian | atlassian_api_token | |||
Atlassian | atlassian_jwt | |||
Azure | azure_active_directory_application_secret | |||
Azure | azure_active_directory_application_secret | |||
Azure | azure_active_directory_application_secret | |||
Azure | azure_batch_key_identifiable | |||
Azure | azure_cache_for_redis_access_key | |||
Azure | azure_cosmosdb_key_identifiable | |||
Azure | azure_devops_personal_access_token | |||
Azure | azure_function_key | |||
Azure | azure_management_certificate | |||
Azure | azure_ml_web_service_classic_identifiable_key | |||
Azure | azure_sas_token | |||
Azure | azure_search_admin_key | |||
Azure | azure_search_query_key | |||
Azure | azure_sql_connection_string | |||
Azure | azure_storage_account_key | |||
Azure | azure_storage_account_key | |||
Beamer | beamer_api_key | |||
Bitbucket | bitbucket_server_personal_access_token | |||
Canadian Digital Service | cds_canada_notify_api_key | |||
Checkout.com | checkout_production_secret_key | |||
Checkout.com | checkout_production_secret_key | |||
Checkout.com | checkout_test_secret_key | |||
Checkout.com | checkout_test_secret_key | |||
Chief Tools | chief_tools_token | |||
Clojars | clojars_deploy_token | |||
CloudBees | codeship_credential | |||
Contentful | contentful_personal_access_token | |||
crates.io | cratesio_api_token | |||
Databricks | databricks_access_token | |||
DevCycle | devcycle_client_api_key | |||
DevCycle | devcycle_mobile_api_key | |||
DevCycle | devcycle_server_api_key | |||
DigitalOcean | digitalocean_oauth_token | |||
DigitalOcean | digitalocean_personal_access_token | |||
DigitalOcean | digitalocean_refresh_token | |||
DigitalOcean | digitalocean_system_token | |||
Discord | discord_bot_token | |||
Discord | discord_bot_token | |||
Doppler | doppler_audit_token | |||
Doppler | doppler_cli_token | |||
Doppler | doppler_personal_token | |||
Doppler | doppler_scim_token | |||
Doppler | doppler_service_account_token | |||
Doppler | doppler_service_token | |||
Dropbox | dropbox_access_token | |||
Dropbox | dropbox_short_lived_access_token | |||
Duffel | duffel_live_access_token | |||
Duffel | duffel_test_access_token | |||
Dynatrace | dynatrace_internal_token | |||
EasyPost | easypost_production_api_key | |||
EasyPost | easypost_test_api_key | |||
eBay | ebay_production_client_id ebay_production_client_secret | |||
eBay | ebay_sandbox_client_id ebay_sandbox_client_secret | |||
facebook_access_token | ||||
Fastly | fastly_api_token | |||
Fastly | fastly_api_token | |||
Figma | figma_pat | |||
Finicity | finicity_app_key | |||
Firebase | firebase_cloud_messaging_server_key | |||
Flutterwave | flutterwave_live_api_secret_key | |||
Flutterwave | flutterwave_test_api_secret_key | |||
Frame.io | frameio_developer_token | |||
Frame.io | frameio_jwt | |||
FullStory | fullstory_api_key | |||
FullStory | fullstory_api_key | |||
GitHub | github_app_installation_access_token | |||
GitHub | github_app_installation_access_token | |||
GitHub | github_oauth_access_token | |||
GitHub | github_oauth_access_token | |||
GitHub | github_personal_access_token | |||
GitHub | github_personal_access_token | |||
GitHub | github_personal_access_token | |||
GitHub | github_refresh_token | |||
GitHub | github_ssh_private_key | |||
GitLab | gitlab_access_token | |||
GoCardless | gocardless_live_access_token | |||
GoCardless | gocardless_sandbox_access_token | |||
google_api_key | ||||
google_cloud_private_key_id | ||||
google_oauth_access_token | ||||
google_oauth_client_id google_oauth_client_secret | ||||
google_oauth_refresh_token | ||||
Grafana | grafana_cloud_api_key | |||
Grafana | grafana_cloud_api_token | |||
Grafana | grafana_project_api_key | |||
Grafana | grafana_project_service_account_token | |||
HashiCorp | hashicorp_vault_batch_token | |||
HashiCorp | hashicorp_vault_batch_token | |||
HashiCorp | hashicorp_vault_root_service_token | |||
HashiCorp | hashicorp_vault_service_token | |||
HashiCorp | hashicorp_vault_service_token | |||
HashiCorp | terraform_api_token | |||
Hubspot | hubspot_api_key | |||
Hubspot | hubspot_api_key | |||
Hubspot | hubspot_api_key | |||
Intercom | intercom_access_token | |||
Ionic | ionic_personal_access_token | |||
Ionic | ionic_personal_access_token | |||
Ionic | ionic_refresh_token | |||
Ionic | ionic_refresh_token | |||
JFrog | jfrog_platform_access_token | |||
JFrog | jfrog_platform_api_key | |||
Linear | linear_api_key | |||
Linear | linear_oauth_access_token | |||
Lob | lob_live_api_key | |||
Lob | lob_test_api_key | |||
Localstack | localstack_api_key | |||
LogicMonitor | logicmonitor_bearer_token | |||
LogicMonitor | logicmonitor_lmv1_access_key | |||
Mailchimp | mailchimp_api_key | |||
Mailgun | mailgun_api_key | |||
Mailgun | mailgun_api_key | |||
Mapbox | mapbox_secret_access_token | |||
MessageBird | messagebird_api_key | |||
Midtrans | midtrans_production_server_key | |||
Midtrans | midtrans_sandbox_server_key | |||
New Relic | new_relic_insights_query_key | |||
New Relic | new_relic_license_key | |||
New Relic | new_relic_personal_api_key | |||
New Relic | new_relic_rest_api_key | |||
Notion | notion_integration_token | |||
Notion | notion_oauth_client_secret | |||
npm | npm_access_token | |||
npm | npm_access_token | |||
npm | npm_access_token | |||
NuGet | nuget_api_key | |||
Octopus Deploy | octopus_deploy_api_key | |||
Onfido | onfido_live_api_token | |||
Onfido | onfido_sandbox_api_token | |||
OpenAI | openai_api_key | |||
OpenAI | openai_api_key | |||
Palantir | palantir_jwt | |||
Persona Identities | persona_production_api_key | |||
Persona Identities | persona_sandbox_api_key | |||
PlanetScale | planetscale_database_password | |||
PlanetScale | planetscale_oauth_token | |||
PlanetScale | planetscale_service_token | |||
Plivo | plivo_auth_id plivo_auth_token | |||
Postman | postman_api_key | |||
Prefect | prefect_server_api_key | |||
Prefect | prefect_user_api_key | |||
Proctorio | proctorio_consumer_key | |||
Proctorio | proctorio_linkage_key | |||
Proctorio | proctorio_registration_key | |||
Proctorio | proctorio_secret_key | |||
Proctorio | proctorio_secret_key | |||
Pulumi | pulumi_access_token | |||
PyPI | pypi_api_token | |||
ReadMe | readmeio_api_access_token | |||
redirect.pizza | redirect_pizza_api_token | |||
RubyGems | rubygems_api_key | |||
Samsara | samsara_api_token | |||
Samsara | samsara_oauth_access_token | |||
SendGrid | sendgrid_api_key | |||
Sendinblue | sendinblue_api_key | |||
Sendinblue | sendinblue_smtp_key | |||
Shippo | shippo_live_api_token | |||
Shippo | shippo_test_api_token | |||
Shopify | shopify_access_token | |||
Shopify | shopify_app_client_credentials | |||
Shopify | shopify_app_client_secret | |||
Shopify | shopify_app_shared_secret | |||
Shopify | shopify_custom_app_access_token | |||
Shopify | shopify_marketplace_token | |||
Shopify | shopify_merchant_token | |||
Shopify | shopify_partner_api_token | |||
Shopify | shopify_private_app_password | |||
Slack | slack_api_token | |||
Slack | slack_api_token | |||
Slack | slack_api_token | |||
Slack | slack_incoming_webhook_url | |||
Slack | slack_workflow_webhook_url | |||
Square | square_access_token | |||
Square | square_access_token | |||
Square | square_access_token | |||
Square | square_production_application_secret | |||
Square | square_sandbox_application_secret | |||
SSLMate | sslmate_api_key | |||
SSLMate | sslmate_api_key | |||
SSLMate | sslmate_cluster_secret | |||
Stripe | stripe_api_key | |||
Stripe | stripe_legacy_api_key | |||
Stripe | stripe_live_restricted_key | |||
Stripe | stripe_test_restricted_key | |||
Stripe | stripe_test_secret_key | |||
Stripe | stripe_webhook_signing_secret | |||
Supabase | supabase_service_key | |||
Supabase | supabase_service_key | |||
Tableau | tableau_personal_access_token | |||
Telegram | telegram_bot_token | |||
Telnyx | telnyx_api_v2_key | |||
Tencent | tencent_cloud_secret_id | |||
Tencent | tencent_wechat_api_app_id | |||
Twilio | twilio_access_token | |||
Twilio | twilio_account_sid | |||
Twilio | twilio_api_key | |||
Typeform | typeform_personal_access_token | |||
Uniwise | wiseflow_api_key | |||
Yandex | yandex_cloud_api_key | |||
Yandex | yandex_cloud_iam_cookie | |||
Yandex | yandex_cloud_iam_token | |||
Yandex | yandex_dictionary_api_key | |||
Yandex | yandex_predictor_api_key | |||
Yandex | yandex_translate_api_key | |||
Zuplo | zuplo_consumer_api_key |
Further reading
- "Quickstart for securing your repository"
- "Keeping your account and data secure"
- "Secret scanning partner program" in the GitHub Enterprise Cloud documentation