The platform continues to strengthen its secret scanning infrastructure through regular updates to detection mechanisms, validation tools, and analysis features. This latest round brings meaningful additions across multiple fronts.

  • Nine fresh secret detectors originating from seven different vendors, among them Langchain, Salesforce, and Figma
  • Push protection now enabled by default for credentials from Figma, Google, OpenVSX, and PostHog
  • Npm access tokens (npm_access_token) now benefit from validity verification capabilities

Those seeking information on earlier detector additions or a comprehensive catalog of recognized secret types should consult the product documentation or review previous announcements.

Detectors added

The scanning system now identifies additional credential categories automatically within codebases.

Detectors covering Drone CI, Netlify, Pydantic, and Twitch remain in observation mode during their validation phase before advancing to full availability status. Updates regarding their progression will be documented in the GitHub changelog.

Through the secret scanning partnership program, partner-issued credentials discovered in public repositories trigger automatic notifications to the issuing organization. Additional details on the technical partnership framework are available in the program documentation.

User-generated secrets trigger alerts whenever they appear in either public or private repositories. Comprehensive information on this functionality can be found in the secret scanning documentation.

Validators added

Several secret categories now incorporate validity verification, which performs automated checks to confirm whether detected credentials remain functional, enabling teams to prioritize remediation efforts more effectively.

Push protection defaults

Additional detectors now come with push protection activated automatically. When this protection is active, commits matching these patterns will be blocked from being pushed.

Default push protection patterns apply universally across all repositories where secret scanning is operational, encompassing free public repositories as well. Patterns designated as configurable allow GitHub secret scanning customers to adjust their push protection settings. Further details on push protection functionality are available in the documentation.

Push protection configurability

GitHub continues refining the secret scanning user experience based on community input. As of now, pattern type names within the push protection configuration interface include links directing users to a filtered view of alerts corresponding to that specific type.

Users with additional suggestions are encouraged to participate in discussions within the GitHub Community forum.

Learn more

Comprehensive information about secret scanning capabilities and a full inventory of supported secret types are documented in the product documentation.

Source: GitHub Blog