GitHub has enhanced its secret scanning capabilities to surface richer metadata about discovered leaked credentials, helping teams understand who owns a compromised secret and assess the scope of potential exposure.
What's changing?
Secret scanning has long included validity checks for most secret providers, confirming whether a detected credential remains active. The new update broadens this capability by pulling additional metadata fields directly from supported providers.
Now in public preview for eligible secret types, the scanning alerts include details such as the secret owner's identity, when the secret was created and when it expires, plus relevant project or organization context—all drawn from the provider when available. For instance, compromised OpenAI keys will now show the owner's name, email address, and identifier, along with organization details if the provider supplies them. This expanded context helps development and security teams triage incidents more efficiently and prioritize fixes based on actual exposure risk.
Metadata availability depends on the secret provider, the token type, and sometimes the specific secret itself at a given moment. GitHub makes a best-effort attempt to surface this information, though not every metadata field will necessarily be present for every secret.
What secret types are supported?
GitHub plans to roll out support for additional secret types on an ongoing basis. Building on earlier announcements about active GitHub token support, extended metadata checks now cover a growing roster of credential types. Consult the full list of supported secrets or monitor the GitHub changelog for new additions.
When is the analysis run for a given secret?
Extended metadata checks activate when a secret meets two conditions: it must be confirmed as currently active and belong to a supported secret type. Additionally, an administrator or security manager must first enable extended metadata checks at the repository level.
Where is metadata displayed?
The extended metadata appears in the right panel of an alert view, alongside other contextual information such as assigned team members or linked security campaigns.
Who can use this feature?
Extended metadata checks are available in public preview to customers with GitHub Secret Protection or GitHub Advanced Security subscriptions on github.com, including those using GitHub Enterprise Cloud with data residency options.
Get started with metadata checks
Administrators can enable this feature through the repository settings interface. Validity checks must be turned on before extended checks can be activated. Once enabled, the alert details view will display additional information for active secrets wherever that data is available from the provider.
For more information, review GitHub's documentation on securing repositories with secret scanning or submit feedback about the secret scanning feature and extended metadata checks.
Source: GitHub Blog