Ensure secret scanning is enabled to detect sensitive data
Why this matters
Secret scanning detects exposed credentials, API keys, tokens, and other sensitive data accidentally committed to repositories.
Without secret scanning, these exposures may go unnoticed and lead to credential misuse, unauthorized access, or data breaches.
Enabling secret scanning ensures that:
- Commits and pushes are automatically scanned for sensitive patterns
- Developers are alerted immediately when credentials are detected
- Repositories meet audit and compliance requirements for secure development practices
Without this control, secrets can remain exposed in version history or public forks, making your organization vulnerable to compromise.
What this check does
This check verifies that:
- Secret scanning is enabled for the repository (GitHub Docs – Configuring secret scanning)
- Push protection is active to block pushes containing known secret patterns (GitHub Docs – About push protection)
- The check passes if both are correctly configured and enabled. If either is disabled or unsupported, the result is reported as “Unable to verify.”
How to fix it
From the GitHub Web Console
Navigate to your repository on GitHub.
- Go to Settings → Security & analysis.
- Under Secret scanning, click Enable.
- Enable Push protection to prevent commits with detected secrets.
If your organization uses private repositories, verify that GitHub Advanced Security or Secret Protection is enabled for your plan.
Using the GitHub REST API (Optional)
You can also enable secret scanning programmatically:
curl \
-X PATCH \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR_TOKEN>" \
https://api.github.com/repos/<owner>/<repo>/secret-scanning \
-d '{"state":"enabled"}'
Refer to GitHub REST API – Secret scanning endpoints for full details.
Exceptions
Secret scanning is automatically enabled for all public repositories.
Private repositories require GitHub Advanced Security to activate this feature.
Custom or organization-defined secret patterns must be configured separately in your security settings.