Freedom251 › Dependency Management Software
GitHub Secret Scanning
What GitHub Secret Scanning is
GitHub Secret Scanning helps identify exposed credentials in code and related GitHub content so they can be secured. It scans every branch in Git history, along with issues, pull requests, discussions, wikis, and secret gists. When a credential is detected, GitHub adds an alert to the repository’s Security and quality tab with details about the exposure. Push protection can block secrets before they reach code. Organizations can create regular-expression patterns for secrets unique to their systems. Generic patterns cover items such as private keys, connection strings, and API keys, while AI detection can identify unstructured secrets such as passwords. GitHub works with service providers to validate some findings and may notify a provider so it can act, including revoking a credential. Validity checks can contact an issuing service to determine whether a detected credential remains active. Scanning runs automatically and free on public repositories. For organization-owned private and internal repositories, secret scanning is available with GitHub Secret Protection on GitHub Team or GitHub Enterprise Cloud. The product is offered through API, web, and self-hosted platforms, with hybrid deployment. GitHub Secret Protection costs $19 a month per active committer.
Who it suits
GitHub Secret Scanning suits organizations that need to find exposed credentials across repository history and other GitHub content. Its custom patterns, push protection, and validity checks are useful for teams managing organization-specific secrets and credential response.
What it does well
- Scans all branches and multiple types of GitHub content.
- Push protection can block secrets before they enter code.
- Organizations can define custom regular-expression patterns.
- AI detection can identify unstructured secrets such as passwords.
- Public repositories receive automatic scanning at no charge.
What to know first
- Private and internal organization repositories require GitHub Secret Protection.
- The listed paid plan is $19 per active committer per month.
Limits
Secret scanning is free for public repositories. Scanning organization-owned private and internal repositories requires GitHub Secret Protection on GitHub Team or GitHub Enterprise Cloud; the listed plan costs $19 a month per active committer.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| GitHub Secret Protection | per active committer/month · Secret scanning and push protection included for Team and Enterprise · Free for public repositories · Validity checks, Copilot secret scanning, generic patterns, bypass controls, security overview insights, and scan history API included for Team and Enterprise | $19 a month |
As github.com lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the GitHub security plans website.
- Use automatic scanning on a public repository, or enable GitHub Secret Protection for an organization-owned private or internal repository.
- Choose GitHub Team or GitHub Enterprise Cloud for organization-owned private or internal repository scanning.
- Use the API, web, or self-hosted platform option.
Verdict
Choose GitHub Secret Scanning if you need credential detection across repository history and related GitHub content, with options to block pushes and check credential validity. Public repositories can use scanning for free; organization-owned private and internal repositories require GitHub Secret Protection.
Questions
Is GitHub Secret Scanning free?
Scanning runs automatically and free on public repositories. The listed GitHub Secret Protection plan costs $19 a month per active committer.
Can it scan private repositories?
Organization-owned private and internal repositories can use secret scanning with GitHub Secret Protection enabled on GitHub Team or GitHub Enterprise Cloud.
What does it scan?
It scans all branches in Git history, plus issues, pull requests, discussions, wikis, and secret gists.
Can it stop secrets from being committed?
Push protection can block secrets before they reach code.
What platforms are available?
The listed platforms are API, self-hosted, and web. The deployment model is hybrid.
Who makes GitHub Secret Scanning?
GitHub makes the product. The company was founded in 2008 and is headquartered in San Francisco, California, United States.
Facts from GitHub Secret Scanning's own pages
- AI detection
- AI-detected secrets can identify unstructured secrets such as passwords. · docs.github.com, 4 Oct 2026
- Alerts
- When it detects a credential leak, GitHub creates an alert on the repository’s Security and quality tab with details about the exposed credential. · docs.github.com, 4 Oct 2026
- Custom patterns
- Organizations can define regular expressions to detect organization-specific secrets not covered by default patterns. · docs.github.com, 4 Oct 2026
- Enterprise option
- GitHub Enterprise Server supports secret scanning for user-owned repositories when the enterprise has GitHub Secret Protection enabled. · docs.github.com, 4 Oct 2026
- Founded
- 2008 · github.com, 28 Sept 2026
- Generic patterns
- Generic patterns can detect secrets not tied to a specific provider, including private keys, connection strings, and generic API keys. · docs.github.com, 4 Oct 2026
- Headquarters
- San Francisco, California, United States · github.com, 28 Sept 2026
- Private repository access
- Organization-owned private and internal repositories can use secret scanning with GitHub Secret Protection enabled on GitHub Team or GitHub Enterprise Cloud. · docs.github.com, 4 Oct 2026
- Provider integration
- GitHub partners with service providers to validate detected secrets and may notify a provider so it can take action, such as revoking the credential. · docs.github.com, 4 Oct 2026
- Public monitoring
- An enterprise can enable public monitoring to detect secrets its members leak in public repositories across GitHub. · docs.github.com, 4 Oct 2026
- Public repositories
- Secret scanning runs automatically for free on public repositories. · docs.github.com, 4 Oct 2026
- Purpose
- Secret scanning automatically detects exposed credentials so they can be secured before they are exploited. · docs.github.com, 4 Oct 2026
- Push protection
- Push protection proactively blocks secrets before they reach code. · github.com, 4 Oct 2026
- Scan coverage
- It scans all branches across Git history and also scans issue and pull request content, discussions, wikis, and secret gists. · docs.github.com, 4 Oct 2026
- Validity checks
- Validity checks determine whether a detected secret is still active and may contact its issuing service to check whether it was revoked. · docs.github.com, 4 Oct 2026