GitHub brings free secret scanning to all public repositories

GitHub security community
(Image credit: GitHub)

GitHub has announced it will be bringing its secret scanning capability to more users in a bid to help public repository admins detect leaked secrets in their repositories before a breach happens.

The launch forms part of the secret scanning partner program, which was set up to notify more than 100 service providers of token exposure in public repositories. 

The function was previous only available to organizations with GitHub Advanced Security, but it will now be available to admins of all public repositories.

Github secret scanning

Github claims to scan for over 200 token formats (like API keys and authentication tokens) that would usually take an average of 327 days to identify, and has already notified its partners of 1.7 million potential secret exposures in public repositories.

Rollout has already begun in beta form, and GitHub hopes that all of its members will have access by the end of January 2023. The company has also pointed at a discussion board where users can request early access or discuss the product in more detail.

“Once secret scanning alerts are available on your repository you can enable them in your repository’s settings under “Code security and analysis” settings," an entry on the company’s blog noted.

"You can see any detected secrets by navigating to the “Security” tab of your repository and selecting “Secret scanning” in the side panel underneath “Vulnerability alerts.” There, you will see a list of any detected secrets, and you can click on any alert to reveal the compromised secret, its location, and suggested action for remediation.”

GitHub 2FA

With an emphasis on its commitment to security, GitHub has also announced that it will require all users who contribute code to set up two-factor authentication (2FA) on their accounts by the end of 2023, which will affect an estimated 94 million users.

A select group of users will first get notified of this mandatory verification in March 2023, which will provide a basis for evaluation before GitHub pushes it to its entire user base.

Craig Hale

With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!

Read more
A graphic showing someone on a tablet working through a supply chain.
Security issue in open source software leaves businesses concerned for systems
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
These fake GitHub "security alerts" could actually let hackers hijack your account
An abstract image of digital security.
Hundreds of GitHub repositories hijacked to trick users into downloading malware
hacker.jpeg
Thousands of GitHub repositories exposed via Microsoft Copilot
Shadowed hands on a digital background reaching for a login prompt.
This worrying Git flaw could lead to users leaking credentials
A white padlock on a dark digital background.
GitHub is hiding malware disguised as games, legitimate software
Latest in Software & Services
TinEye website
I like this reverse image search service the most
A person in a wheelchair working at a computer.
Here’s a free way to find long lost relatives and friends
A white woman with long brown hair in a ponytail looks down at her computer in a distressed manner. She is holding her forehead with one hand and a credit card with the other
This people search finder covers all the bases, but it's not perfect
That's Them home page
Is That's Them worth it? My honest review
woman listening to computer
AWS vs Azure: choosing the right platform to maximize your company's investment
A person at a desktop computer working on spreadsheet tables.
Trello vs Jira: which project management solution is best for you?
Latest in News
A young woman is working on a laptop in a relaxed office space.
I’ll admit, Microsoft’s new Windows 11 update surprised me with its usefulness, providing accessibility fixes, a gamepad keyboard layout, and PC spec cards
inZOI promotional material.
inZOI has become the most wishlisted game on Steam, but I wouldn't get too caught up in the hype
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Nespresso Vertuo Pop machine in Candy Pink with coffee drinks and capsules
My favorite Nespresso coffee maker just got a fresh new makeover, and now I love it even more
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC