secret-scanning

You can enable GitHub secret scanning and push protection by toggling Secret Protection within repository, organization, or enterprise settings. This blocks leaked credentials during command-line pushes, UI uploads, and REST API content creation flows.

Resolve a blocked push by removing the detected secret from your commits. Alternatively, use the bypass or delegated bypass workflows, providing the correct reasons and timing, to push the content while maintaining secret scanning audit trails.

Create custom patterns for GitHub secret scanning by defining regex-based secret formats in your repository settings, optionally using Copilot-assisted regex generation. You can enable push protection for these custom patterns if they exhibit low false-positive rates.

Triage secret scanning alerts by reviewing user, push-protection, or partner alerts to understand validity checks. Remediate exposed credentials by dismissing false positives appropriately, rotating detected secrets, and deciding whether to rewrite Git history.

Configure secret_scanning.yml exclusions by specifying operational settings and requirements in the .github/secret_scanning.yml file. This defines paths and patterns to exclude from secret scanning, ensuring safe, low-noise coverage across your codebase.