- Home
- Static Application Security Testing Sast
- GitHub Secret Scanning
GitHub Secret Scanning
San Francisco, California, United States
What it is
GitHub Secret Scanning detects exposed credentials so teams can secure them before misuse. It scans every branch in Git history, plus issues, pull requests, discussions, wikis, and secret gists. Detected leaks generate repository alerts with details about the credential, while push protection can block secrets before they enter code. Organizations can define regular-expression patterns for their own secrets. Generic patterns cover private keys, connection strings, and API keys, and AI detection can identify unstructured secrets such as passwords. Validity checks may contact an issuing service to determine whether a credential remains active. GitHub partners with service providers that can validate findings and may revoke credentials. Scanning runs automatically and free on public repositories. Private and internal organization repositories require GitHub Secret Protection on Team or Enterprise Cloud; Enterprise Server supports user-owned repositories with that protection. The service is available through API, web, and self-hosted deployments. The paid plan is $19 per active committer/month.
For and against
For
- Scans code history and collaboration content
- Blocks secrets before they reach code
- Supports custom and generic detection patterns
- Checks whether credentials remain active
- Available through API, web, and self-hosted options
Against
- Private repository use requires Secret Protection
- Paid plan is $19 per active committer/month
- Some capabilities depend on plan and repository type
The verdict
GitHub Secret Scanning covers detection, prevention, validation, and provider response across GitHub content. Teams should match repository ownership and required controls to the available plan.
Who it suits
It suits development and security teams that need repository-wide credential detection, push blocking, custom patterns, and remediation workflows. Public repositories can use scanning at no charge.
Plans and prices
GitHub Secret Protection
Secret scanning and push protection included for Team and Enterprise · Free for public repositories · Validity checks, Copilot secret scanning, generic patterns, bypass controls, security overview insights, and scan history API included for Team and Enterprise
Read 4 Oct 2026 · github.com
On the record
- AI detection
- AI-detected secrets can identify unstructured secrets such as passwords.docs.github.com · read 4 Oct 2026
- Alerts
- When it detects a credential leak, GitHub creates an alert on the repository’s Security and quality tab with details about the exposed credential.docs.github.com · read 4 Oct 2026
- Custom patterns
- Organizations can define regular expressions to detect organization-specific secrets not covered by default patterns.docs.github.com · read 4 Oct 2026
- Enterprise option
- GitHub Enterprise Server supports secret scanning for user-owned repositories when the enterprise has GitHub Secret Protection enabled.docs.github.com · read 4 Oct 2026
- Generic patterns
- Generic patterns can detect secrets not tied to a specific provider, including private keys, connection strings, and generic API keys.docs.github.com · read 4 Oct 2026
- Private repository access
- Organization-owned private and internal repositories can use secret scanning with GitHub Secret Protection enabled on GitHub Team or GitHub Enterprise Cloud.docs.github.com · read 4 Oct 2026
- Provider integration
- GitHub partners with service providers to validate detected secrets and may notify a provider so it can take action, such as revoking the credential.docs.github.com · read 4 Oct 2026
- Public monitoring
- An enterprise can enable public monitoring to detect secrets its members leak in public repositories across GitHub.docs.github.com · read 4 Oct 2026
- Public repositories
- Secret scanning runs automatically for free on public repositories.docs.github.com · read 4 Oct 2026
- Purpose
- Secret scanning automatically detects exposed credentials so they can be secured before they are exploited.docs.github.com · read 4 Oct 2026
- Push protection
- Push protection proactively blocks secrets before they reach code.github.com · read 4 Oct 2026
- Scan coverage
- It scans all branches across Git history and also scans issue and pull request content, discussions, wikis, and secret gists.docs.github.com · read 4 Oct 2026
- Validity checks
- Validity checks determine whether a detected secret is still active and may contact its issuing service to check whether it was revoked.docs.github.com · read 4 Oct 2026
