Skip to main content

支持的机密扫描模式

支持的机密列表和 GitHub 与之合作的合作伙伴,以防止欺诈性使用意外提交的机密。

谁可以使用此功能?

Secret scanning 可用于以下存储库:

  • 公共存储库(免费)
  • 使用启用了 GitHub Advanced Security 的 GitHub Enterprise Cloud 的组织中的专用存储库和内部存储库

关于 secret scanning 模式

有三种类型的 机密扫描警报:

  • 用户警报:在存储库中检测到支持的机密时,在存储库的安全选项卡中向用户报告。
  • 推送保护警报:当参与者绕过推送保护时,在存储库的安全选项卡中向用户报告。
  • 合作伙伴警报:直接向属于 secret scanning 合作伙伴计划的机密提供方报告。 这些警报不会在存储库的安全选项卡中报告。

有关每种警报类型的深入信息,请参阅“关于机密扫描警报”。

有关所有受支持的模式的详细信息,请参阅下面的“支持的机密”部分。

如果使用 REST API 进行 secret scanning,可以使用 Secret type 报告来自特定颁发者的机密。 有关详细信息,请参阅“适用于机密扫描的 REST API 终结点”。

如果你认为 secret scanning 应检测到提交到存储库的机密,但却尚未检测到,则首先需要检查 GitHub 是否支持你的机密。 有关详细信息,请参阅以下部分。 有关高级故障排除的详细信息,请参阅“排查机密扫描问题”。

支持的机密

下表列出了 secret scanning 支持的机密。 可以查看为每个令牌生成的警报类型,以及是否对令牌执行验证检查。

  • 提供商 - 令牌提供商的名称。

  • 合作伙伴 - 将泄漏报告给相关令牌合作伙伴的令牌。 仅适用于公共存储库。

  • 用户 - 向 GitHub 上的用户报告泄漏的令牌。

  • 推送保护 - 向 GitHub 上的用户报告泄漏的令牌。 适用于启用了 secret scanning 和推送保护的存储库。

  • 验证检查 - 实现其验证检查的令牌。 当前仅适用于 GitHub 令牌,未在表格中显示。 有关验证检查支持的详细信息,请参阅 GitHub Enterprise Cloud 文档中的“支持的机密扫描模式”。

提供程序标记Partner用户推送保护
Adafruitadafruit_io_key
Adobeadobe_client_secret
Adobeadobe_device_token
Adobeadobe_pac_token
Adobeadobe_refresh_token
Adobeadobe_service_token
Adobeadobe_short_lived_access_token
Aivenaiven_auth_token
Aivenaiven_service_password
Alibabaalibaba_cloud_access_key_id
alibaba_cloud_access_key_secret
Amazon AWSaws_access_key_id
aws_secret_access_key
Amazon AWSaws_secret_access_key
aws_session_token
aws_temporary_access_key_id
Anthropicanthropic_api_key
Anthropicanthropic_session_id
Asaasasaas_api_token
Asanaasana_legacy_format_personal_access_token
Asanaasana_personal_access_token
Atlassianatlassian_api_token
Token versions
Atlassianatlassian_jwt
Authressauthress_service_client_access_key
Azureazure_active_directory_application_secret
Token versions
Azureazure_active_directory_user_credential
Azureazure_apim_direct_management_key
Azureazure_apim_gateway_key
Azureazure_apim_repository_key
Azureazure_apim_subscription_key
Azureazure_app_configuration_connection_string
Azureazure_batch_key_identifiable
Azureazure_cache_for_redis_access_key
Azureazure_communication_services_connection_string
Azureazure_container_registry_key_identifiable
Azureazure_cosmosdb_key_identifiable
Azureazure_devops_personal_access_token
Azureazure_event_hub_key_identifiable
Azureazure_function_key
Azureazure_iot_device_connection_string
Azureazure_iot_device_key
Azureazure_iot_device_provisioning_key
Azureazure_iot_hub_connection_string
Azureazure_iot_hub_key
Azureazure_iot_provisioning_connection_string
Azureazure_management_certificate
Azureazure_ml_web_service_classic_identifiable_key
Azureazure_openai_key
Azureazure_relay_key_identifiable
Azureazure_sas_token
Azureazure_search_admin_key
Azureazure_search_query_key
Azureazure_service_bus_identifiable
Azureazure_signalr_connection_string
Azureazure_sql_connection_string
Azureazure_sql_password
Azureazure_storage_account_key
Token versions
Azureazure_web_pub_sub_connection_string
Azuremicrosoft_corporate_network_user_credential
Baidubaiducloud_api_accesskey
Beamerbeamer_api_key
Bitbucketbitbucket_server_personal_access_token
Canadian Digital Servicecds_canada_notify_api_key
Canvacanva_app_secret
Canvacanva_connect_api_secret
Canvacanva_secret
Cashfreecashfree_api_key
Cfx.recfxre_server_key
Checkout.comcheckout_production_secret_key
Token versions
Checkout.comcheckout_test_secret_key
Token versions
Chief Toolschief_tools_token
CircleCIcircleci_bot_access_token
CircleCIcircleci_personal_access_token
CircleCIcircleci_project_access_token
CircleCIcircleci_release_integration_token
Clojarsclojars_deploy_token
CloudBeescodeship_credential
Contentfulcontentful_personal_access_token
Contributed Systemscontributed_systems_credentials
Coveocoveoaccesstoken
Coveocoveoapikey
crates.iocratesio_api_token
Databricksdatabricks_access_token
Datadogdatadog_api_key
Datadogdatadog_app_key
Defined Networkingdefined_networking_nebula_api_key
DevCycledevcycle_client_api_key
DevCycledevcycle_mobile_api_key
DevCycledevcycle_server_api_key
DigitalOceandigitalocean_oauth_token
DigitalOceandigitalocean_personal_access_token
DigitalOceandigitalocean_refresh_token
DigitalOceandigitalocean_system_token
Discorddiscord_bot_token
Token versions
Dockerdocker_personal_access_token
Dopplerdoppler_audit_token
Dopplerdoppler_cli_token
Dopplerdoppler_personal_token
Dopplerdoppler_scim_token
Dopplerdoppler_service_account_token
Dopplerdoppler_service_token
Dropboxdropbox_access_token
Dropboxdropbox_short_lived_access_token
Duffelduffel_live_access_token
Duffelduffel_test_access_token
Dynatracedynatrace_api_token
Dynatracedynatrace_internal_token
EasyPosteasypost_production_api_key
EasyPosteasypost_test_api_key
eBayebay_production_client_id
ebay_production_client_secret
eBayebay_sandbox_client_id
ebay_sandbox_client_secret
Facebookfacebook_access_token
Fastlyfastly_api_token
Token versions
Figmafigma_pat
Finicityfinicity_app_key
Firebasefirebase_cloud_messaging_server_key
Flutterwaveflutterwave_live_api_secret_key
Flutterwaveflutterwave_test_api_secret_key
Frame.ioframeio_developer_token
Frame.ioframeio_jwt
FullStoryfullstory_api_key
Token versions
GitHubgithub_app_installation_access_token
Token versions
GitHubgithub_oauth_access_token
Token versions
GitHubgithub_personal_access_token
Token versions
GitHubgithub_refresh_token
GitHubgithub_ssh_private_key
GitHubgithub_test_token
GitHub Secret Scanningsecret_scanning_sample_token
GitLabgitlab_access_token
GoCardlessgocardless_live_access_token
GoCardlessgocardless_sandbox_access_token
Googlegoogle_api_key
Googlegoogle_cloud_service_account_credentials
Googlegoogle_cloud_storage_access_key_secret
google_cloud_storage_service_account_access_key_id
Googlegoogle_cloud_storage_access_key_secret
google_cloud_storage_user_access_key_id
Googlegoogle_oauth_access_token
Googlegoogle_oauth_client_id
google_oauth_client_secret
Googlegoogle_oauth_refresh_token
Grafanagrafana_cloud_api_key
Grafanagrafana_cloud_api_token
Grafanagrafana_project_api_key
Grafanagrafana_project_service_account_token
HashiCorphashicorp_vault_batch_token
Token versions
HashiCorphashicorp_vault_root_service_token
HashiCorphashicorp_vault_service_token
Token versions
HashiCorpterraform_api_token
Highnotehighnote_rk_live_key
Highnotehighnote_rk_test_key
Highnotehighnote_sk_live_key
Highnotehighnote_sk_test_key
HOPhop_bearer
HOPhop_pat
HOPhop_ptk
Hubspothubspot_api_key
Token versions
Hubspothubspot_personal_access_key
Hubspothubspot_smtp_credential
Token versions
Hugging Facehf_org_api_key
Hugging Facehf_user_access_token
IBMibm_cloud_iam_key
IBMibm_softlayer_api_key
Intercomintercom_access_token
Ionicionic_personal_access_token
Token versions
Ionicionic_refresh_token
Token versions
Iterativeiterative_dvc_studio_access_token
JFrogjfrog_platform_access_token
JFrogjfrog_platform_api_key
JFrogjfrog_platform_reference_token
LaunchDarklylaunchdarkly_access_token
Lightspeedlightspeed_xs_pat
Linearlinear_api_key
Linearlinear_oauth_access_token
Loblob_live_api_key
Loblob_test_api_key
Localstacklocalstack_api_key
LogicMonitorlogicmonitor_bearer_token
LogicMonitorlogicmonitor_lmv1_access_key
Login with Amazonamazon_oauth_client_id
amazon_oauth_client_secret
amazon_oauth_client_secret
Mailchimpmailchimp_api_key
Mailchimpmandrill_api_key
Mailgunmailgun_api_key
Token versions
Mailgunmailgun_smtp_credential
Mapboxmapbox_secret_access_token
MaxMindmaxmind_license_key
Mercurymercury_non_production_api_token
Mercurymercury_production_api_token
Mergifymergify_application_key
MessageBirdmessagebird_api_key
Midtransmidtrans_production_server_key
Midtransmidtrans_sandbox_server_key
Netflixnetflix_netkey
New Relicnew_relic_insights_query_key
New Relicnew_relic_license_key
New Relicnew_relic_personal_api_key
New Relicnew_relic_rest_api_key
Notionnotion_integration_token
Notionnotion_oauth_client_secret
npmnpm_access_token
Token versions
NuGetnuget_api_key
Octopus Deployoctopus_deploy_api_key
Oculusoculus_access_token
OneChronosonechronos_api_key
OneChronosonechronos_eb_api_key
OneChronosonechronos_eb_encryption_key
OneChronosonechronos_oauth_token
OneChronosonechronos_refresh_token
Onfidoonfido_live_api_token
Onfidoonfido_sandbox_api_token
OpenAIopenai_api_key
Token versions
Orbitorbit_api_token
PagerDutypagerduty_oauth_secret
PagerDutypagerduty_oauth_token
Palantirpalantir_jwt
Persona Identitiespersona_production_api_key
Persona Identitiespersona_sandbox_api_key
Pinterestpinterest_access_token
Pinterestpinterest_refresh_token
PlanetScaleplanetscale_database_password
PlanetScaleplanetscale_oauth_token
PlanetScaleplanetscale_service_token
Plivoplivo_auth_id
plivo_auth_token
Polarpolar_access_token
Polarpolar_authorization_code
Polarpolar_client_registration_token
Polarpolar_client_secret
Polarpolar_personal_access_token
Polarpolar_refresh_token
Postmanpostman_api_key
Postmanpostman_collection_key
Prefectprefect_server_api_key
Prefectprefect_user_api_key
Proctorioproctorio_consumer_key
Proctorioproctorio_linkage_key
Proctorioproctorio_registration_key
Proctorioproctorio_secret_key
Token versions
Pulumipulumi_access_token
PyPIpypi_api_token
ReadMereadmeio_api_access_token
redirect.pizzaredirect_pizza_api_token
Replicatereplicate_api_token
Rootlyrootly_api_key
RubyGemsrubygems_api_key
Samsarasamsara_api_token
Samsarasamsara_oauth_access_token
Segmentsegment_public_api_token
SendGridsendgrid_api_key
Sendinbluesendinblue_api_key
Sendinbluesendinblue_smtp_key
Sentrysentry_integration_token
Sentrysentry_org_auth_token
Sentrysentry_user_app_auth_token
Sentrysentry_user_auth_token
Shipposhippo_live_api_token
Shipposhippo_test_api_token
Shopeeshopee_open_platform_partner_key
Shopifyshopify_access_token
Shopifyshopify_app_client_credentials
Shopifyshopify_app_client_secret
Shopifyshopify_app_shared_secret
Shopifyshopify_custom_app_access_token
Shopifyshopify_marketplace_token
Shopifyshopify_merchant_token
Shopifyshopify_partner_api_token
Shopifyshopify_private_app_password
Siemenssiemens_api_token
Siemenssiemens_code_token
Sindrisindri_api_key
Token versions
Slackslack_api_token
Token versions
Slackslack_incoming_webhook_url
Slackslack_workflow_webhook_url
Squaresquare_access_token
Token versions
Squaresquare_production_application_secret
Squaresquare_sandbox_application_secret
SSLMatesslmate_api_key
Token versions
SSLMatesslmate_cluster_secret
Stripestripe_api_key
Stripestripe_legacy_api_key
Stripestripe_live_restricted_key
Stripestripe_test_restricted_key
Stripestripe_test_secret_key
Stripestripe_webhook_signing_secret
Supabasesupabase_service_key
Token versions
Tableautableau_personal_access_token
Telegramtelegram_bot_token
Telnyxtelnyx_api_v2_key
Tencenttencent_cloud_secret_id
Tencenttencent_wechat_api_app_id
Thunderstorethunderstore_io_api_token
Twiliotwilio_access_token
Twiliotwilio_account_sid
Twiliotwilio_api_key
Typeformtypeform_personal_access_token
Uniwisewiseflow_api_key
Unkeyunkey_root_key
VolcEnginevolcengine_access_key_id
Wakatimewakatime_api_key
Wakatimewakatime_app_secret
Wakatimewakatime_oauth_access_token
Wakatimewakatime_oauth_refresh_token
Workatoworkato_developer_api_token
Token versions
WorkOSworkos_production_api_key
Token versions
WorkOSworkos_staging_api_key
Token versions
Yandexyandex_cloud_api_key
Yandexyandex_cloud_iam_access_secret
Yandexyandex_cloud_iam_cookie
Yandexyandex_cloud_iam_token
Yandexyandex_cloud_smartcaptcha_server_key
Yandexyandex_dictionary_api_key
Yandexyandex_passport_oauth_token
Yandexyandex_predictor_api_key
Yandexyandex_translate_api_key
Zuplozuplo_consumer_api_key

令牌版本

服务提供方会更新用于定期生成令牌的模式,并且可能支持多个版本的令牌。 推送保护仅支持 secret scanning 可放心识别的最新令牌版本。 这样可以避免在结果可能是误报时,不必要地阻止提交推送保护,这种情况在使用旧令牌时更有可能发生。

其他阅读材料