►
Description
There's nothing worse than committing a secret. With GitHub Advanced Security you'll be notified if you try to push changes that include secrets. Learn more about secret scanning from our Senior Engineering Manager Aaron on this episode of our Checkout videos.
With Aaron Waggener and Michelle Mannering (AKA MishManners)
Check out the docs on GitHub Advanced Security: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
See the features available under GitHub Advanced Security: https://github.com/advanced-security/
Secret scanning for free public repos: https://github.blog/changelog/2022-12-15-secret-scanning-is-now-available-for-free-on-public-repositories/
Secret scanning push protection on custom patterns: https://github.blog/changelog/2022-12-15-secret-scanning-now-push-protects-custom-patterns/
Free secret scanning alerts for all: https://github.blog/2023-02-28-secret-scanning-alerts-are-now-available-and-free-for-all-public-repositories/
Enterprise level patterns: https://github.blog/changelog/2023-01-04-secret-scanning-can-now-push-protect-enterprise-level-custom-patterns/
Changes to secret scanning: https://github.blog/changelog/2023-03-03-secret-scanning-changes-coming-to-how-you-opt-in-to-alert-notifications/
Stay up-to-date on all things GitHub by subscribing and following us at:
YouTube: http://bit.ly/subgithub
Blog: https://github.blog
Twitter: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
Facebook: http://fb.com/github
About GitHub
It’s where over 100 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com
A
Hey
y'all
Moosh
here
and
I've
got
a
GitHub
feature
for
you
to
check
out
if
you've
been
following
along
our
changelogs
you've
seen
all
the
really
cool
features
we've
been
shipping
and
there
have
been
a
ton
of
really
cool
features,
and
one
of
these
things
that
has
received
a
lot
of
updates
recently
is
secret
scanning
and
to
talk
to
us
through
all
these
changes
on
secret
scanning.
We
have
Aaron
Aaron
over
to
you.
B
Yeah
thanks
Mitch.
There
were
just
a
number
of
things
that
we've
shipped
since
Universe
since
GitHub
universe,
that
I
thought
I
would
share
with
y'all
today
and
I'll
go
through
some
Demos
in
just
a
minute,
but
just
like
a
quick
overview.
First
thing
that
I
want
to
talk
about
today,
which
you'll
see
in
the
demo
is
scan
issues.
Historically,
we've
focused
mostly
on
git
content,
alerting
people
and
preventing
secrets
from
being
checked
into
code
and.
A
B
Our
effort
to
go
beyond
that
and
into
issues
issue
body
and
comments,
We
Now
scan
for
the
next
feature.
We
added
links
to
partner
docs
in
product,
so
anytime,
you're,
looking
at
an
alert
for
a
secret
for
one
of
our
partner
patterns,
you'll
now
get
a
link
to
their
documentation,
explaining
kind
of
what
that
secret
might
be.
What
that
token
is
and
steps
to
remediate
it
so
again,
just
trying
to
make
that
remediation
process
a
little
bit
smoother.
We
also
shipped
an
Enterprise
level,
enablement
rest
API.
B
This
is
something
our
larger
customers
were
asking
for,
who
use
GitHub,
Advanced
security,
previously
larger
customers,
who
enable
secret
scanning
everywhere
had
to
make
a
number
of
API
calls
to
different
orgs
in
their
Enterprise.
Now,
with
a
single
API
call,
they
can
enable
secret
scanning
everywhere
and
just
manage
enablement.
That
way
in
these
single
calls.
The
next
one
is
push
protection
for
custom
patterns,
so
we've
had
push
protection
and
we
also
had
custom
patterns
which
launched
and
our
customers
have
been
asking
us
like.
Can
we
use
these
things
together?
We
have
these
custom
patterns.
B
It's
very
important
for
us
to
add
push
protection
for
some
of
these
patterns.
They're
very
high
confidence.
Can
we
do
that,
and
so
now
we've
released
a
feature
where,
when
you
create
a
custom
pattern,
you
have
the
option
to
promote
it
as
a
push
protection
to
prevent
those
secrets
from
ever
being
checked
into
a
repository.
Lastly,
we
now
have
this
a
big
one
for
us.
B
We
now
have
our
alert
experience
available
for
free
on
all
public
repositories
and
TechCrunch
had
a
great
write-up
on
this
one
recently
repository
admins
of
free
public
repos,
so
that
could
be
a
large
open
source
project
or
just
like
a
small
side
project
that
you're
doing
and
developing
in
public.
Now
on
any
any
repo
like
that,
any
free
public
repo
you
can
enable
the
secret
scanning
detection
experience.
We
believe
this
really
furthers
our
team's
mission
of
putting
them
to
credential
based
breaches.
B
So,
let's
get
into
a
demo,
as
you
can
see
I'm
in
my
repository
here
and
I'm
going
to
demo.
The
scan
issues
feature
that
I
mentioned
earlier,
so
I'll
go
here
into
issues
and
I'll
create
a
new
issue
and
I'll
just
say
here
is
the
access
token
here,
I'll
submit
this
issue
and
then
we'll.
We
should
see
it
here
in
our
secret
scanning
alerts
and
there
it
is
yeah.
So
that
was
a
demonstration
of
the
secret
which
is
found
in
the
issue.
B
As
we
can
see
here,
the
secret
is
compromised
and
we
pull
out
the
full
secret,
so
you
can
have
it
here,
also
looking
back
to
where
it
was
found.
If
you
have
many
issues
or
other
discussions
and
whatnot,
we
think
right
to
it
here.
Another
feature
I
mentioned,
which
happens
to
be
right
here
on
this
page
I
talked
about
linking
out
to
partner
docs
for
tokens.
B
You
can
see
is
here
now
where
we
have
the
suggested
action
so
for
any
partner
token
that
we
have,
we
now
have
a
link
out
to
their
docs
to
show
how
to
either
remediate
it
or
revoke
it.
But
if
you
need
some
guidance
on
what
this
token
is
or
how
to
take
action
on
it,
you
link
out
straight
to
the
docs
here.
It
should
take
me
over
to
the
npm
site,
because
it
was
an
npm
token
how
to
enable
push
protection
on
a
custom
pattern.
B
So
I'm
here
in
our
settings,
code,
security
and
Analysis
I'm-
going
to
go
down
here
to
the
advanced
security
area
down
here
to
secret
scanning,
and
then
we
have
our
custom
patterns
section
so
I'll
create
a
new
pattern
for
this
repository
and
again
this
would
be
a
typical
use
case
might
be.
A
company
has
their
own
API
pattern,
for
maybe
some
internal
all
apis
that
they
have
and
that's
not
something
we
would
have
in
our
partner
patterns,
but
something
they
would
want
to
enter
here.
B
So
I
will
call
oops
call
that
company
pattern
did
there
and
then
the
secret
format,
so
just
I'm
just
prepending
it,
maybe
company
name
underscore
API,
whatever
the
format
of
the
secret
is
that
the
company
is
minting
and
then
I'll
test
that
here
that
should
match.
Okay,
that's
a
match,
so
that's
doing
what
I
expect
it
to
going
to
save
and
dry
run
it.
It's
queued
up
for
a
dry
run
and
it
didn't
find
any
matches
for
that
in
our
repository
yet,
which
is
great,
I
will
publish
the
pattern.
B
The
new
feature
here
is
this
section
here
which
will
allow
us
to
enable
that
pattern
for
push
protection,
so
I'll
enable
that
it
is
enabled.
So
now,
if
I
go
over
to,
let's
go
over
the
code
I'll
edit,
this
file
I,
believe
that
was
the
pattern
that
should
match
I'll
just
commit
try
to
commit
directly
to
the
to
main
here
and
when
I
try
to
commit
it.
We
see
here
we
have
this
area.
Air
push
protection
for
Secrets
found
a
company
pattern
on
line
five.
So
it's
alerted
me
to
this
pattern
and
it
will
not.
B
Let
me
push
it.
You
would
have
a
very
similar
experience
if
you
were
maybe
using
the
command
line
and
doing
a
git
push
there.
You
would
block
it
there
or
you
know,
within
your
IDE,
basically
anywhere
you're,
trying
to
commit
code
with
that
pattern.
It
will
get
blocked
yeah.
Those
are
the
demos
of
some
of
the
things
that
we've
shipped
since
Universe
for
secret
scamming.
A
Thanks
to
the
Aaron,
there
are
so
many
cool
things
to
do
with
Secrets,
getting
and
I'm
sure.
Lots
of
people
will
be
really
excited
about
these
now
you've
mentioned
a
few
different
features
about
secret
scanning.
What
is
one
of
your
favorite
new
features
that
have
recently
been
released
on
secret
scanning.
B
Oh
man,
my
favorite
one
of
the
certainly
of
the
ones
that
we've
demoed
today
I
mean
I,
don't
know
about
favorite,
but
I
just
love
the
idea
of
marrying
together
the
custom
patterns
and
the
push
protection.
These
are
two
features
that
have
been
kind
of
living
side
by
side
for
a
while
now
and
it
was
just
had
gotten
a
lot
of
customer
requests
to
bring
them
together,
and
there
was
some
different
architectural
reasons.
B
A
B
We
definitely
have
I
think
like
a
focus
on
just
like
making
remediation
easier,
so
I
can
tell
you,
in
the
short
term,
we're
working
on
providing
validity
checks
for
GitHub
tokens.
So
if
you
have
a
GitHub
token,
that's
been
committed
and
you
find
and
you
get
alerted
to
it
in
your
repository,
we'll
be
able
to
show
you
immediately
just
in
product.
In
our
view
there,
whether
the
token
is
still
valid
and
I,
would
consider
that
kind
of
like
a
step,
one
of
a
multi-step
process
just
to
make
remediation
easier.
B
A
Thanks
I'm
sure
people
will
be
really
excited
to
see
the
new
things
coming
for
secret
scanning
Aaron.
Thank
you
for
being
here
today
and
showing
us
and
walking
us
through
a
demo
of
all
the
really
cool
things
in
a
secret
scanning.
So
that's
all
we
have
today
for
our
checkout
video.
Let
us
know
in
the
comments
below
your
favorite
secret
scanning
features
just
been
released
and
make
sure
to
like
And
subscribe.
So
you
don't
miss
more
checkout
videos
and
we'll
see
you
on
the
next
checkout
video
catch.
You
then.