{"meta":{"title":"Secret scanning","intro":"Prevent fraudulent use of your secrets by automatically detecting exposed credentials before they can be exploited.","product":"Security and code quality","breadcrumbs":[{"href":"/en/enterprise-server@3.17/code-security","title":"Security and code quality"},{"href":"/en/enterprise-server@3.17/code-security/concepts","title":"Concepts"},{"href":"/en/enterprise-server@3.17/code-security/concepts/secret-security","title":"Secret security"},{"href":"/en/enterprise-server@3.17/code-security/concepts/secret-security/secret-scanning","title":"Secret scanning"}],"documentType":"article"},"body":"# Secret scanning\n\nPrevent fraudulent use of your secrets by automatically detecting exposed credentials before they can be exploited.\n\nWhen credentials like API keys and passwords are committed to repositories as hardcoded secrets, they become targets for unauthorized access. Secret scanning automatically detects credential leaks so you can secure them before they're exploited.\n\n## How secret scanning protects your code\n\nSecret scanning scans your entire Git history on all branches of your repository for hardcoded credentials, including API keys, passwords, tokens, and other known secret types. This helps you identify secret sprawl, the uncontrolled proliferation of credentials across repositories, before it becomes a security risk. GitHub also periodically rescans repositories when new secret types are added.\n\nGitHub also automatically scans:\n\n* Descriptions and comments in issues\n* Titles, descriptions, and comments, in open and closed *historical* issues\n* Titles, descriptions, and comments in pull requests\n* Titles, descriptions, and comments in GitHub Discussions\n* Secret gists\n\n### Secret scanning alerts and remediation\n\nWhen secret scanning detects a credential leak, GitHub generates an alert on your repository's ** Security** tab with details about the exposed credential.\n\nWhen you receive an alert, rotate the affected credential immediately to prevent unauthorized access. While you can also remove secrets from your Git history, this is time-intensive and often unnecessary if you've already revoked the credential.\n\n## Customizability\n\nBeyond the default detection of partner and provider secrets, you can expand and customize secret scanning to fit your needs.\n\n* **Generic patterns.** Expand detection to secrets that aren't tied to a specific service provider, such as private keys, connection strings, and generic API keys.\n* **Custom patterns.** Define your own regular expressions to detect organization-specific secrets that aren't covered by default patterns.\n* **Validity checks.** Prioritize remediation by checking whether detected secrets are still active.\n\n## How can I access this feature?\n\nSecret scanning is available for the following repository types:\n\n* **Public repositories**: Secret scanning runs automatically for free.\n* **Organization-owned private and internal repositories**: Available with [GitHub Secret Protection](/en/enterprise-server@3.17/get-started/learning-about-github/about-github-advanced-security) enabled on GitHub Team or GitHub Enterprise Cloud.\n* **User-owned repositories**: Available on GitHub Enterprise Cloud with Enterprise Managed Users. Available on GitHub Enterprise Server when the enterprise has [GitHub Secret Protection](/en/enterprise-server@3.17/get-started/learning-about-github/about-github-advanced-security) enabled."}