secret-scanning

Detect and remediate leaked credentials across GitHub repositories.

Updated Mar 31, 2026

Search Tags:#github #security-automation #secret-scanning #push-protection #alerts-remediation #credentials-rotation

Ready to run

npx skills add https://github.com/LawrenceHwang/flappy_bird --skill secret-scanning-lawrencehwang

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-scanning
Source: https://github.com/LawrenceHwang/flappy_bird/tree/main/.github/skills/secret-scanning
Command: npx skills add https://github.com/LawrenceHwang/flappy_bird --skill secret-scanning-lawrencehwang

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Detecting and remediating leaked credentials across a repository can be challenging and risky; secret scanning with push protection helps prevent exposure by catching secrets before they are pushed, scanned, or merged.

Core Features & Use Cases

Enable GitHub secret scanning and push protection at the repository or organization level to block leaked credentials.
Define custom patterns to catch organization-specific secrets and tailor remediation workflows.
Triage, dismiss, rotate credentials, and remediate alerts across history, PRs, issues, and discussions.

Quick Start

Enable secret scanning and push protection in your repository settings, then configure custom patterns and alert remediation to prevent secret leaks.

Frequently Asked Questions about secret-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How does push protection prevent leaked credentials in a repository?▼

Secret scanning detects and remediates leaked credentials by scanning repositories. It enables secret protection, push protection, and custom patterns, then triages alerts and rotates credentials to resolve blocked pushes across history, PRs, and discussions.

How do I enable GitHub secret scanning and configure custom patterns?▼

Configure custom patterns in repository settings to scan for organization-specific secrets. Use reference materials to implement tailored pattern definitions, enabling secret scanning to detect proprietary credentials that standard providers do not automatically catch.

Do I need Advanced Security to use secret scanning and push protection?▼

Alert triage and remediation involve dismissing false positives, rotating compromised credentials, and resolving blocked pushes. You manage these alerts across repository history, pull requests, issues, and discussions to ensure leaked secrets are fully addressed.

What is the best way to triage secret scanning alerts and rotate credentials?▼

Push protection blocks pushes containing detected secrets before they enter the repository. It prevents exposure by stopping the commit, requiring you to remove the secret from the code or remediate the alert before the push can succeed.