secret-scanning

Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.

33,218stars4,045forksUpdated 5/18/2026

DevOps & CI/CD Security Code Review Git & Version Control #pre-commit #security #devops #github #secret-scanning #code-review

Security Assessment

Low Risk(75/100)

Detected risks:

Secret Exposure([references/custom-patterns.md] Password=)

Sensitive File Access([references/alerts-and-remediation.md] .env)

Security Score75/100

About secret-scanning

The secret-scanning skill is designed to help developers and security teams manage GitHub secret scanning effectively. It addresses the challenge of accidentally exposing sensitive credentials, such as API keys, private keys, or passwords, in a codebase. By providing structured guidance for configuring secret scanning, push protection, custom secret patterns, and alert management, this skill ensures that sensitive information is detected and remediated before it can be leaked or misused. The skill also integrates with pre-commit scanning workflows in AI coding agents via the GitHub MCP Server, leveraging the Advanced Security plugin to automate secret detection during development.

This skill offers several key capabilities. It enables secret scanning across all branches, Git history, issues, pull requests, discussions, wikis, and gists. Users can configure push protection to prevent secrets from being pushed to repositories, define custom patterns for detecting organization-specific secrets, and set up exclusions via a `.github/secret_scanning.yml` file. Additional features include AI-powered generic secret detection, non-provider pattern scanning, and validity checks to verify whether detected secrets are still active. The skill also provides guidance for triaging and remediating alerts, resolving blocked pushes, and configuring delegated bypass for push protection, allowing teams to maintain secure development workflows while minimizing disruption.

Typical use cases include enabling and configuring secret scanning for individual repositories or organizations, preventing accidental secret leaks during code commits, and integrating secret detection into automated AI-assisted coding workflows. Target users are developers, DevOps engineers, and security teams responsible for safeguarding sensitive information within GitHub repositories. By following the skill's procedural guidance, these users can implement robust secret scanning practices, manage alerts efficiently, and maintain compliance with internal security policies.

FAQ

How do I enable secret scanning for my repository?

Navigate to the repository Settings → Advanced Security, then click Enable next to 'Secret Protection'. Confirm the action to activate secret scanning. For organizations, use the security configurations under Global settings to enable it at scale.

Which types of repositories support secret scanning?

Public repositories have automatic, free access to secret scanning. Private or internal organization-owned repositories require GitHub Secret Protection on Team/Enterprise Cloud. User-owned repositories require Enterprise Cloud with Enterprise Managed Users.

Can I exclude certain directories from secret scanning?

Yes, by creating a `.github/secret_scanning.yml` file with a 'paths-ignore' list. This file can exclude specific directories or file patterns from both secret scanning and push protection, with a limit of 1,000 entries and files under 1 MB.

Does secret scanning work before commits are pushed?

Yes, push protection blocks secrets during the push process, including command line pushes, GitHub UI commits, file uploads, and REST API content creation endpoints. Pre-commit scanning via AI coding agents can also detect secrets before commits.

What additional features can I enable for more thorough detection?

You can enable non-provider pattern scanning to detect private keys or API keys, AI-powered generic secret detection for unstructured secrets, and validity checks to verify if detected secrets are still active, all available under Settings → Advanced Security.