Skip to content
SPECIFICTION
Get listed

GitHub Secret Scanning

github.com

From $19/mo WebAPISelf-hosted
Visit github.com
Spec score 7.8 #9 of 24 in Static Application Security Testing Sast

What it is

GitHub Secret Scanning detects exposed credentials so they can be secured before exploitation. It scans every branch in Git history, plus issue and pull request content, discussions, wikis, and secret gists. Detected leaks produce repository alerts with details about the credential, while push protection can block secrets before they enter code. Organizations can define regular expressions for their own secret formats. Generic patterns cover items such as private keys, connection strings, and API keys, and AI detection can identify unstructured secrets such as passwords. Validity checks may contact issuing services to see whether credentials remain active. GitHub can work with providers to validate findings and notify them for actions such as revocation. Scanning is automatic and free for public repositories. Private and internal organization repositories require Secret Protection on GitHub Team or Enterprise Cloud; Enterprise Server supports user-owned repositories with that protection. It is available through API, web, and self-hosted deployment, with hybrid deployment.

Spec sheet

Purpose
Secret scanning automatically detects exposed credentials so they can be secured before they are exploited.Read 4 Oct 2026 · docs.github.com
Headquarters
San Francisco, California, United StatesRead 28 Sep 2026 · github.com
Founded
2008Read 28 Sep 2026 · github.com
AI detection
AI-detected secrets can identify unstructured secrets such as passwords.Read 4 Oct 2026 · docs.github.com
Alerts
When it detects a credential leak, GitHub creates an alert on the repository’s Security and quality tab with details about the exposed credential.Read 4 Oct 2026 · docs.github.com
Custom patterns
Organizations can define regular expressions to detect organization-specific secrets not covered by default patterns.Read 4 Oct 2026 · docs.github.com
Enterprise option
GitHub Enterprise Server supports secret scanning for user-owned repositories when the enterprise has GitHub Secret Protection enabled.Read 4 Oct 2026 · docs.github.com
Generic patterns
Generic patterns can detect secrets not tied to a specific provider, including private keys, connection strings, and generic API keys.Read 4 Oct 2026 · docs.github.com
Private repository access
Organization-owned private and internal repositories can use secret scanning with GitHub Secret Protection enabled on GitHub Team or GitHub Enterprise Cloud.Read 4 Oct 2026 · docs.github.com
Provider integration
GitHub partners with service providers to validate detected secrets and may notify a provider so it can take action, such as revoking the credential.Read 4 Oct 2026 · docs.github.com
Public monitoring
An enterprise can enable public monitoring to detect secrets its members leak in public repositories across GitHub.Read 4 Oct 2026 · docs.github.com
Public repositories
Secret scanning runs automatically for free on public repositories.Read 4 Oct 2026 · docs.github.com
Push protection
Push protection proactively blocks secrets before they reach code.Read 4 Oct 2026 · github.com
Scan coverage
It scans all branches across Git history and also scans issue and pull request content, discussions, wikis, and secret gists.Read 4 Oct 2026 · docs.github.com
Validity checks
Validity checks determine whether a detected secret is still active and may contact its issuing service to check whether it was revoked.Read 4 Oct 2026 · docs.github.com

Plans and prices

GitHub Secret Protection $19 a month per active committer/month Secret scanning and push protection included for Team and Enterprise · Free for public repositories · Validity checks, Copilot secret scanning, generic patterns, bypass controls, security overview insights, and scan history API included for Team and Enterprise Read 4 Oct 2026 · github.com

Every GitHub Secret Scanning plan and price →

Strong points and limits

Strong points

  • Scans branches and repository collaboration content
  • Push protection can block secrets before code
  • Custom patterns cover organization-specific credentials
  • Validity checks assess whether secrets remain active
  • API, web, and self-hosted options

Limits

  • Private repositories require Secret Protection plans
  • Paid plan starts at $19 a month
  • Provider validation may contact issuing services

Who it suits

This suits organizations that need credential detection across repository history and collaboration content. It is relevant to teams using public repositories or protected private and internal repositories.

Verdict

GitHub Secret Scanning combines broad content coverage with blocking, custom detection, and credential validity checks. Public repositories receive automatic free scanning, while protected private usage depends on eligible GitHub plans.

Where Specifiction places it

Alternatives to GitHub Secret ScanningAll alternatives →