Leaked credentials expose your organization to data breaches. GitHub Secret Protection detects and prevents secret leaks automatically. Follow this five-phase adoption path to assess your current risk, evaluate GitHub Secret Protection, run a pilot, monitor its value, and scale protection across your organization.
Secrets like API keys, passwords, and tokens committed to repositories can be exploited by unauthorized users, creating security, compliance, and financial risk to your organization.
Running the secret risk assessment for your organization
Determine your organization's exposure to leaked secrets by generating a secret risk assessment report.
Interpreting secret risk assessment results
Understand the results from your secret risk assessment and prioritize leak remediation.
Viewing your security risk assessment reports
Understand your organization's exposure to leaked secrets and code vulnerabilities by viewing your most recent security risk assessment reports.
Prevent fraudulent use of your secrets by automatically detecting exposed credentials before they can be exploited.
Secure your secrets by stopping them from ever reaching your repository with push protection.
Public monitoring for secret scanning
Public monitoring detects credentials leaked by your enterprise members in public repositories across GitHub, giving you visibility into secret exposure beyond your enterprise's boundaries.
Supported secret scanning patterns
Lists of supported secrets and the partners that GitHub works with to prevent fraudulent use of secrets that were committed accidentally.
Estimating the price of Secret Protection
Learn how to use the pricing calculator to estimate the monthly cost of GitHub Secret Protection for your repositories.
Calculating the cost savings of push protection
Estimate the remediation time and labor costs you'll avoid by preventing leaked secrets.
Setting up a trial of GitHub Advanced Security
Evaluate GitHub Code Security and GitHub Secret Protection on your existing repositories before you buy.
Best practices for selecting pilot repositories
The right pilot repositories demonstrate value quickly and prepare your organization for broader enablement of GitHub Secret Protection.
Pricing and enabling GitHub Secret Protection
Secure your organization's secrets within your budget by enabling GitHub Secret Protection.
Enabling push protection for your repository
With push protection, secret scanning blocks contributors from pushing secrets to a repository and generates an alert whenever a contributor bypasses the block.
Remediating a leaked secret in your repository
Learn how to respond effectively to a leaked secret in your GitHub repository.
Assessing the impact of GitHub Secret Protection
Measure how GitHub Secret Protection reduces secret exposure across your organization, so you can demonstrate value and identify areas to strengthen your security posture.
Secret scanning push protection metrics
Understand push protection's performance across your organizations.
Organizing remediation efforts for leaked secrets
Systematically organize and manage the remediation of leaked secrets using security campaigns and alert assignments.
Evaluating alerts from secret scanning
Learn about additional features that can help you evaluate alerts and prioritize their remediation, such as checking a secret's validity.
Viewing and managing public monitoring alerts
Find and manage alerts for credentials your enterprise members have exposed in public repositories across GitHub.
Applying a custom security configuration
You can apply your custom security configuration to repositories in your organization to meet the specific security needs of those repositories.
Defining custom patterns for secret scanning
Protect your unique secret types by defining custom patterns with regular expressions.
Enabling delegated bypass for push protection
Control who can push code containing secrets by requiring bypass approval from designated reviewers.
Enabling secret scanning for generic patterns
You can enable secret scanning to detect additional potential secrets at the repository and organization levels.
Enabling generic secret detection for AI-detected secrets
You can enable generic secret detection for your repository or organization. Alerts for generic secrets, such as passwords, are displayed in a separate list on the secret scanning alerts page.
Scanning for secrets with the GitHub MCP server
Detect exposed secrets in real time from your AI coding agent, before they ever reach your repository.
Enabling public monitoring for your enterprise
Start detecting secrets your enterprise members leak in public repositories outside your enterprise's boundaries.