secret-scanning

Secret scanning detects and remediates leaked credentials by scanning repositories. It enables secret protection, push protection, and custom patterns, then triages alerts and rotates credentials to resolve blocked pushes across history, PRs, and discussions.

Configure custom patterns in repository settings to scan for organization-specific secrets. Use reference materials to implement tailored pattern definitions, enabling secret scanning to detect proprietary credentials that standard providers do not automatically catch.

Alert triage and remediation involve dismissing false positives, rotating compromised credentials, and resolving blocked pushes. You manage these alerts across repository history, pull requests, issues, and discussions to ensure leaked secrets are fully addressed.

Push protection blocks pushes containing detected secrets before they enter the repository. It prevents exposure by stopping the commit, requiring you to remove the secret from the code or remediate the alert before the push can succeed.