secret-scanning

Go to repository Settings, then Advanced Security, and enable Secret Protection followed by Push protection. For organizations, use security configurations under Global settings to enable both features at scale across repositories.

Remove the secret from the file and amend the commit with git commit --amend, or use interactive rebase if it is in an earlier commit. Alternatively, visit the bypass URL from the error message, select a reason, and re-push within 3 hours.

Navigate to Settings, Advanced Security, Custom patterns, and select New pattern. Enter a name and regex, add a sample test string, run a dry run to check for false positives, then publish the pattern and optionally enable push protection.

Secret scanning is automatic and free on public repositories. Private and internal organization-owned repositories require GitHub Secret Protection, available on Team or Enterprise Cloud plans.

Rotate the exposed credential immediately by revoking it and issuing a new one; this matters more than removing it from Git history. Then check the validity status, update references, investigate usage, and close the alert with an appropriate resolution reason.

Create a .github/secret_scanning.yml file with a paths-ignore list of glob patterns, such as docs/** or test fixtures. Excluded paths skip both scanning and push protection, with a limit of 1,000 entries.