{"meta":{"title":"Organizing remediation efforts for leaked secrets","intro":"Systematically organize and manage the remediation of leaked secrets using security campaigns and alert assignments.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/tutorials","title":"Tutorials"},{"href":"/en/code-security/tutorials/secure-your-organization","title":"Secure your organization"},{"href":"/en/code-security/tutorials/secure-your-organization/organize-leak-remediation","title":"Organize leak remediation"}],"documentType":"article"},"body":"# Organizing remediation efforts for leaked secrets\n\nSystematically organize and manage the remediation of leaked secrets using security campaigns and alert assignments.\n\n## Introduction\n\nIn this tutorial, you'll organize remediation efforts for leaked secrets. You'll learn how to:\n\n* Create security campaigns to track remediation work\n* Assign alerts based on ownership\n* Monitor remediation progress\n* Communicate with stakeholders\n\n## Prerequisites\n\n* You must have both GitHub Secret Protection and secret scanning enabled for your organization. See [Pricing and enabling GitHub Secret Protection](/en/code-security/how-tos/secure-at-scale/configure-organization-security/configure-specific-tools/protect-your-secrets).\n* You must have existing secret scanning alerts available.\n\n## Step 1: Review your secret scanning alerts\n\nBefore taking action, you need to understand the current state of your organization's security alerts.\n\n1. On GitHub, navigate to the main page of the organization.\n\n2. Under your organization name, click the ** Security and quality** tab.\n\n3. In the left sidebar, under \"Findings\", click the symbol to the right of **Secret scanning**.\n\n4. In the dropdown list, select `Default`. `Default` relates to supported patterns and specified custom patterns.\n\n5. Alternatively, you can select `Generic` to review unstructured secrets like passwords. However, generic patterns typically produce more false positives than default patterns, so consider reviewing these alerts after addressing higher-priority leaks.\n\n6. Review the total number of open alerts and repositories affected.\n\n7. Use filters to identify the most urgent alerts and prioritize your remediation efforts.\n * To show leaks in **public** repositories, use `publicly-leaked`.\n * To show secret leaks found in **more than one repository** within the same organization or enterprise, use `is:multi-repository`.\n * To show secrets that are still **valid**, use `validity:active`.\n * To filter by specific **service** credentials (AWS, Azure, GitHub), use `provider:`.\n * To filter by specific **token types**, use `secret-type:`.\n\n8. Optionally, in the sidebar under \"Insights,\" click **Secret scanning** to see:\n * Secret types that have been blocked or bypassed most frequently\n * Repositories with the most blocked pushes or bypasses\n\n## Step 2: Create a security campaign\n\nYou can set up a security campaign to organize and track your remediation work across repositories.\n\n1. Navigate to your organization and click ** Security and quality**.\n2. On the left panel, select ** Campaigns**.\n3. Click **Create campaign **, then either:\n * Select a pre-defined Secrets campaign template.\n * Use custom filters to target specific alerts (for example, `is:open provider:azure` or `is:open validity:active`).\n4. Review the alerts (maximum 1000) and adjust filters if needed.\n5. Click **Save as** and choose **Publish campaign**.\n6. Fill out your campaign information, then click **Publish campaign**.\n\n## Step 3: Assign alerts to team members\n\nAfter creating your campaign, you'll want to assign individual alerts to the developers responsible for fixing them.\n\n1. On your campaign page, click to expand a repository and view its alerts.\n2. Click an alert to open its details page.\n3. In the right sidebar, click **Assignees**.\n4. Select a developer you want to fix the alert. Typically, this is the person who committed the secret or the repository administrator where the leak is detected. They must have write access.\n\n## Step 4: Monitor remediation progress\n\nOnce alerts are assigned, you need to regularly track your campaign's progress to ensure timely completion.\n\n1. On your campaign page, review the campaign summary. You'll see:\n * **Campaign progress**: How many alerts are closed (fixed or dismissed) or still left to review\n * **Status**: How many days until the campaign's due date\n2. You can explore campaign details:\n * Expand any repository to see its progress in alert remediation.\n * Set **Group by** to **None** to show a list of all alerts.\n * Use filters to focus on specific repositories or alerts.\n3. Identify areas needing attention based on repositories with the most open alerts or no recent progress, then reach out to support those repository maintainers or assignees.\n\n## Step 5: Communicate with stakeholders\n\nThroughout the remediation process, you should keep stakeholders informed with regular progress updates. You can use information from your campaign dashboard to help you generate these updates.\n\n1. Navigate to the campaign dashboard.\n2. Identify the information you want to include in your reports. Consider these key metrics:\n * Alerts resolved this week\n * Remaining open alerts\n * On-track vs. at-risk items\n * Notable achievements or blockers\n3. Incorporate the metrics into your update, then distribute via email, Slack, Teams, or security meetings.\n\n## Step 6: Document remediation procedures\n\nFinally, you should create standardized procedures to make future remediation efforts more efficient.\n\n1. Develop secret-type-specific guides. For example:\n * **AWS credentials**: How to rotate access keys and update services\n * **GitHub tokens**: How to revoke and regenerate Personal Access Tokens\n * **API keys**: Service-specific rotation procedures\n * **Database credentials**: Safe rotation without service disruption\n2. Create a remediation checklist.\n 1. Verify the secret is actually leaked.\n 2. Determine if the secret is still active.\n 3. Revoke or rotate the compromised secret.\n 4. Update all systems using the old secret.\n 5. Test that systems function with new credentials.\n 6. Document the incident and remediation steps.\n 7. Mark the alert as resolved.\n3. Establish escalation paths.\n * Define when to escalate to security leadership.\n * Identify subject matter experts for different secret types.\n * Create incident response procedures for critical leaks."}