Keep your secrets secret

GitHub Secret Protection detects and prevents secret leaks continuously in real-time, proactively blocking sensitive credentials from being pushed to a repository with push protection. With a remarkably low false positive rate and approximately 150 service provider integrations, it enables rapid credential revocation and rotation, enhancing developer productivity.

The secret risk assessment provides a free, comprehensive overview of an organization’s secret leak footprint across its GitHub repositories. By analyzing repositories for exposed secrets, it helps admins and developers understand their exposure to potential security risks and offers actionable insights for remediation. Learn more about GitHub security risk assessments.

Push protection is designed to prevent sensitive information, such as secrets or tokens, from being pushed to your repository in the first place. It proactively scans your code for secrets during the push process and blocks the push if any are detected.

Delegated bypass introduces an approval process for developers to bypass push protection. Anyone opting to bypass a push protection block will need to submit a request to a designated group of reviewers, ensuring any risky secrets are not accidentally leaked.

Validity checks help you determine whether detected secrets are still active, enabling developers and security teams to prioritize their response effectively. When a secret is flagged, the system verifies its validity to confirm whether the secret is active or inactive.

The secret scanning partnership program allows service providers to secure their token formats by enabling GitHub to scan public repositories and npm packages for exposed secrets. When a secret is found in a public repo, GitHub sends an alert directly to the service provider, who can then validate and take appropriate action.

GitHub secret scanning detects provider, generic, and custom organization-defined secret types. Provider secrets are tied to a specific secret issuer from GitHub’s secret scanning partnership program. Generic secrets aren’t tied to a specific provider and use both traditional regex and AI-based methods. AI-detected secrets use a purpose-built, fine-tuned model to detect secrets without a recognizable format, optimized for recall and precision.

Public monitoring extends visibility beyond the repositories you control by identifying secrets leaked anywhere across public GitHub and attributing them back to your enterprise using GitHub-specific signals such as enterprise membership and verified domains.