Skip to main content
我们经常发布文档更新,此页面的翻译可能仍在进行中。 有关最新信息,请访问英语文档

机密扫描模式

支持的机密列表和 GitHub 与之合作的合作伙伴,以防止欺诈性使用意外提交的机密。

合作伙伴的机密扫描警报 在 GitHub.com 上的公共存储库中自动运行,以向服务提供商通知泄漏的机密情况。

用户的机密扫描警报 在所有公共存储库上免费提供。 使用 GitHub Enterprise Cloud 且拥有 GitHub Advanced Security 许可证的组织也可以在其专用存储库和内部存储库上启用 用户的机密扫描警报。

如果你的企业拥有 GitHub Advanced Security 的许可证,则 有关详细信息,请参阅 “关于机密扫描”和“关于 GitHub 高级安全性”。

About secret scanning patterns

GitHub Enterprise Cloud maintains these different sets of default secret scanning patterns:

  1. Partner patterns. Used to detect potential secrets in all public repositories as well as public npm packages. To find out about our partner program, see "Secret scanning partner program."

  2. User alert patterns. Used to detect potential secrets in repositories with secret scanning alerts for users enabled.

  3. Push protection patterns. Used to detect potential secrets in repositories with secret scanning as a push protection enabled.

For details about all the supported patterns, see the "Supported secrets section below.

If you believe that secret scanning should have detected a secret committed to your repository, and it has not, you first need to check that GitHub supports your secret. For more information, refer to the sections below. For more advanced troubleshooting information, see "Troubleshooting secret scanning."

About partner alerts

Partner alerts are alerts that are sent to the secret providers whenever a secret leak is reported for one of their secrets. GitHub Enterprise Cloud currently scans public repositories and public npm packages for secrets issued by specific service providers and alerts the relevant service provider whenever a secret is detected in a commit. For more information about secret scanning alerts for partners, see "About secret scanning."

If access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.

About user alerts

User alerts are alerts that are reported to users on GitHub. When secret scanning alerts for users are enabled, GitHub scans repositories for secrets issued by a large variety of service providers and generates secret scanning alerts.

You can see these alerts on the Security tab of the repository. For more information about secret scanning alerts for users, see "About secret scanning."

If access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.

If you use the REST API for secret scanning, you can use the Secret type to report on secrets from specific issuers. For more information, see "Secret scanning."

Note: You can also define custom secret scanning patterns for your repository, organization, or enterprise. For more information, see "Defining custom patterns for secret scanning."

About push protection alerts

Push protection alerts are user alerts that are reported by push protection. Secret scanning as a push protection currently scans repositories for secrets issued by some service providers.

If access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.

Older versions of certain tokens may not be supported by push protection as these tokens may generate a higher number of false positives than their most recent version. Push protection may also not apply to legacy tokens. For tokens such as Azure Storage Keys, GitHub only supports recently created tokens, not tokens that match the legacy patterns. For more information about push protection limitations, see "Troubleshooting secret scanning."

Supported secrets

This table lists the secrets supported by secret scanning. You can see the types of alert that get generated for each token, as well as whether a validity check is performed on the token.

  • Provider—name of the token provider.
  • Partner—token for which leaks are reported to the relevant token partner. Applies to public repositories only.
  • User—token for which leaks are reported to users on GitHub. Applies to public repositories, and to private repositories where GitHub Advanced Security is enabled.
  • Push protection—token for which leaks are reported to users on GitHub. Applies to repositories with secret scanning and push protection enabled.
  • Validity check—token for which a validity check is implemented. Currently only applies to GitHub tokens.
ProviderTokenPartnerUserPush protectionValidity check
Adafruit IOadafruit_io_key
Adobeadobe_device_token
Adobeadobe_jwt
Adobeadobe_service_token
Adobeadobe_short_lived_access_token
Aivenaiven_auth_token
Aivenaiven_service_password
Alibaba Cloudalibaba_cloud_access_key_id
alibaba_cloud_access_key_secret
Amazonamazon_oauth_client_id
amazon_oauth_client_secret
Amazon Web Services (AWS)aws_access_key_id
aws_secret_access_key
Amazon Web Services (AWS)aws_session_token
aws_temporary_access_key_id
aws_secret_access_key
Asanaasana_personal_access_token
Atlassianatlassian_api_token
Atlassianatlassian_jwt
Atlassianbitbucket_server_personal_access_token
Azureazure_active_directory_application_secret
Azureazure_batch_key_identifiable
Azureazure_cache_for_redis_access_key
Azureazure_cosmosdb_key_identifiable
Azureazure_devops_personal_access_token
Azureazure_ml_studio_classic_web_service_key
azure_ml_web_service_classic_identifiable_key
Azureazure_ml_web_service_classic_identifiable_key
Azureazure_sas_token
Azureazure_search_admin_key
Azureazure_search_query_key
Azureazure_management_certificate
Azureazure_sql_connection_string
Azureazure_storage_account_key
Beamerbeamer_api_key
Canadian Digital Servicecds_canada_notify_api_key
Checkout.comcheckout_production_secret_key
Checkout.comcheckout_test_secret_key
Chief Toolschief_tools_token
Clojarsclojars_deploy_token
CloudBees CodeShipcodeship_credential
Contentfulcontentful_personal_access_token
Contributed SystemsCONTRIBUTED_SYSTEMS_CREDENTIALS
Databricksdatabricks_access_token
DatadogDATADOG_API_KEY
DevCycledevcycle_client_api_key
DevCycledevcycle_mobile_api_key
DevCycledevcycle_server_api_key
DigitalOceandigitalocean_oauth_token
DigitalOceandigitalocean_personal_access_token
DigitalOceandigitalocean_refresh_token
DigitalOceandigitalocean_system_token
Discorddiscord_api_token_v2
Discorddiscord_bot_token
Dopplerdoppler_audit_token
Dopplerdoppler_cli_token
Dopplerdoppler_personal_token
Dopplerdoppler_scim_token
Dopplerdoppler_service_token
Dropboxdropbox_access_token
Dropboxdropbox_short_lived_access_token
Duffelduffel_live_access_token
Duffelduffel_test_access_token
Dynatracedynatrace_access_token
Dynatracedynatrace_internal_token
EasyPosteasypost_production_api_key
EasyPosteasypost_test_api_key
eBayebay_production_client_id
ebay_production_client_secret
eBayebay_sandbox_client_id
ebay_sandbox_client_secret
Fastlyfastly_api_token
Figmafigma_pat
Finicityfinicity_app_key
Flutterwaveflutterwave_live_api_secret_key
Flutterwaveflutterwave_test_api_secret_key
Frame.ioframeio_developer_token
Frame.ioframeio_jwt
FullStoryfullstory_api_key
GitHubgithub_app_installation_access_token
GitHubgithub_oauth_access_token
GitHubgithub_personal_access_token
GitHubgithub_refresh_token
GitHubgithub_ssh_private_key
GitLabgitlab_access_token
GoCardlessgocardless_live_access_token
GoCardlessgocardless_sandbox_access_token
Googlefirebase_cloud_messaging_server_key
Googlegoogle_cloud_storage_service_account_access_key_id
google_cloud_storage_access_key_secret
Googlegoogle_cloud_storage_user_access_key_id
google_cloud_storage_access_key_secret
Googlegoogle_oauth_access_token
Googlegoogle_oauth_client_id
google_oauth_client_secret
Googlegoogle_oauth_refresh_token
Google Cloudgoogle_api_key
Google Cloudgoogle_cloud_private_key_id
Grafanagrafana_api_key
Grafanagrafana_cloud_api_key
Grafanagrafana_cloud_api_token
Grafanagrafana_project_api_key
Grafanagrafana_project_service_account_token
HashiCorphashicorp_vault_batch_token
HashiCorphashicorp_vault_batch_token
HashiCorphashicorp_vault_root_service_token
HashiCorphashicorp_vault_root_service_token
HashiCorphashicorp_vault_service_token
HashiCorphashicorp_vault_service_token
Hashicorp Terraformterraform_api_token
Highnotehighnote_rk_live_key
Highnotehighnote_rk_test_key
Highnotehighnote_sk_live_key
Highnotehighnote_sk_test_key
Hubspothubspot_api_key
Hubspothubspot_api_personal_access_key
Intercomintercom_access_token
Ionicionic_personal_access_token
Ionicionic_refresh_token
JD Cloudjd_cloud_access_key
JFrogjfrog_platform_access_token
JFrogjfrog_platform_api_key
Linearlinear_api_key
Linearlinear_oauth_access_token
Loblob_live_api_key
Loblob_test_api_key
LocalStacklocalstack_api_key
LogicMonitorlogicmonitor_bearer_token
LogicMonitorlogicmonitor_lmv1_access_key
Mailchimpmailchimp_api_key
MailchimpMANDRILL_API
Mailgunmailgun_api_key
Mapboxmapbox_secret_access_token
MessageBirdmessagebird_api_key
Metafacebook_access_token
Midtransmidtrans_production_server_key
Midtransmidtrans_sandbox_server_key
New Relicnew_relic_insights_query_key
New Relicnew_relic_license_key
New Relicnew_relic_personal_api_key
New Relicnew_relic_rest_api_key
Notionnotion_integration_token
Notionnotion_oauth_client_secret
npmnpm_access_token
NuGetnuget_api_key
Octopus Deployoctopus_deploy_api_key
Oculusoculus_very_tiny_encrypted_session
Onfidoonfido_live_api_token
Onfidoonfido_sandbox_api_token
OpenAIopenai_api_key
Palantirpalantir_jwt
Personapersona_production_api_key
Personapersona_sandbox_api_key
PlanetScaleplanetscale_database_password
PlanetScaleplanetscale_oauth_token
PlanetScaleplanetscale_service_token
Plivoplivo_auth_id
plivo_auth_token
Postmanpostman_api_key
Postmanpostman_collection_key
Prefectprefect_server_api_key
Prefectprefect_user_api_key
PrefectPREFECT_USER_API_TOKEN
Proctorioproctorio_consumer_key
Proctorioproctorio_linkage_key
Proctorioproctorio_registration_key
Proctorioproctorio_secret_key
Pulumipulumi_access_token
PyPIpypi_api_token
ReadMereadmeio_api_access_token
redirect.pizzaredirect_pizza_api_token
RubyGemsrubygems_api_key
Samsarasamsara_api_token
Samsarasamsara_oauth_access_token
Segmentsegment_public_api_token
SendGridsendgrid_api_key
Sendinbluesendinblue_api_key
Sendinbluesendinblue_smtp_key
Shipposhippo_live_api_token
Shipposhippo_test_api_token
Shopifyshopify_access_token
Shopifyshopify_app_client_credentials
Shopifyshopify_app_client_secret
Shopifyshopify_app_shared_secret
Shopifyshopify_custom_app_access_token
Shopifyshopify_marketplace_token
Shopifyshopify_merchant_token
Shopifyshopify_partner_api_token
Shopifyshopify_private_app_password
Slackslack_api_token
Slackslack_incoming_webhook_url
Slackslack_workflow_webhook_url
Squaresquare_access_token
Squaresquare_production_application_secret
Squaresquare_sandbox_application_secret
SSLMatesslmate_api_key
SSLMatesslmate_cluster_secret
Stripestripe_api_key
Stripestripe_live_restricted_key
Stripestripe_live_secret_key
Stripestripe_api_key
Stripestripe_test_restricted_key
Stripestripe_test_secret_key
Stripestripe_webhook_signing_secret
Supabasesupabase_service_key
Tableautableau_personal_access_token
Telegramtelegram_bot_token
Telnyxtelnyx_api_v2_key
Tencent Cloudtencent_cloud_secret_id
Tencent WeChattencent_wechat_api_app_id
Twiliotwilio_access_token
Twiliotwilio_account_sid
Twiliotwilio_api_key
Typeformtypeform_personal_access_token
Uniwisewiseflow_api_key
WakaTimewakatime_pp_secret
WakaTimewakatime_oauth_access_token
WakaTimewakatime_oauth_refresh_token
WorkOSworkos_production_api_key
WorkOSworkos_staging_api_key
Yandexyandex_iam_access_secret
Yandexyandex_cloud_api_key
Yandexyandex_cloud_iam_cookie
Yandexyandex_cloud_iam_token
Yandexyandex_dictionary_api_key
YandexYANDEX_PASSPORT_OAUTH_TOKEN
Yandexyandex_predictor_api_key
Yandexyandex_translate_api_key
Zuplozuplo_consumer_api_key

Further reading