diff --git a/content/code-security/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale.md b/content/code-security/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale.md index fddbafeb1c..0c441683a0 100644 --- a/content/code-security/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale.md +++ b/content/code-security/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale.md @@ -122,7 +122,7 @@ Before you can proceed with pilot programs and rolling out {% data variables.pro **Note:** When {% data variables.product.prodname_secret_scanning %} detects a secret in repositories owned by organizations that use {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GH_advanced_security %}, {% data variables.product.prodname_dotcom %} alerts all users with access to security alerts for the repository. {% ifversion ghec %} -Secrets found in public repositories using {% data variables.product.prodname_secret_scanning_partner_alerts%} are reported directly to the partner, without creating an alert on {% data variables.product.product_name %}. For details about the supported partner patterns, see "[Supported secrets for partner alerts](/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-partner-alerts)."{% endif %} +Secrets found in public repositories using {% data variables.secret-scanning.partner_alerts %} are reported directly to the partner, without creating an alert on {% data variables.product.product_name %}. For details about the supported partner patterns, see "[Supported secrets for partner alerts](/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-partner-alerts)."{% endif %} {% endnote %} diff --git a/content/code-security/getting-started/github-security-features.md b/content/code-security/getting-started/github-security-features.md index 064b7d0247..e69486f27d 100644 --- a/content/code-security/getting-started/github-security-features.md +++ b/content/code-security/getting-started/github-security-features.md @@ -72,7 +72,7 @@ The security overview shows which security features are enabled for the reposito {% ifversion fpt or ghec %} ## Available for free public repositories -### {% data variables.product.prodname_secret_scanning_partner_alerts_caps %} +### {% data variables.secret-scanning.partner_alerts_caps %} Automatically detect leaked secrets across all public repositories. {% data variables.product.company_short %} informs the relevant service provider that the secret may be compromised. For details of the supported secrets and service providers, see "[Supported secrets for partner alerts](/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-partner-alerts)." @@ -96,7 +96,7 @@ Many {% data variables.product.prodname_GH_advanced_security %} features are ava Automatically detect security vulnerabilities and coding errors in new or modified code. Potential problems are highlighted, with detailed information, allowing you to fix the code before it's merged into your default branch. For more information, see "[About code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)." -### {% data variables.product.prodname_secret_scanning_user_alerts_caps %} +### {% data variables.secret-scanning.user_alerts_caps %} {% ifversion fpt %} {% data reusables.secret-scanning.secret-scanning-alerts-beta %} @@ -107,7 +107,7 @@ Limited to free public repositories. Available only with a license for {% data variables.product.prodname_GH_advanced_security %}. {% endif %} -Automatically detect tokens or credentials that have been checked into a repository. You can view alerts for any secrets that {% data variables.product.company_short %} finds in your code, in the "Security" tab of the repository, so that you know which tokens or credentials to treat as compromised. For more information, see {% ifversion fpt or ghec %}"[About {% data variables.product.prodname_secret_scanning_user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)"{% elsif ghes %}"[About {% data variables.product.prodname_secret_scanning_user_alerts %} on {% data variables.product.product_name %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-on-github-enterprise-server){% elsif ghae %}"[About {% data variables.product.prodname_secret_scanning_user_alerts %} on {% data variables.product.product_name %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-on-github-ae){% endif %}." +Automatically detect tokens or credentials that have been checked into a repository. You can view alerts for any secrets that {% data variables.product.company_short %} finds in your code, in the "Security" tab of the repository, so that you know which tokens or credentials to treat as compromised. For more information, see {% ifversion fpt or ghec %}"[About {% data variables.secret-scanning.user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)"{% elsif ghes %}"[About {% data variables.secret-scanning.user_alerts %} on {% data variables.product.product_name %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-on-github-enterprise-server){% elsif ghae %}"[About {% data variables.secret-scanning.user_alerts %} on {% data variables.product.product_name %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-on-github-ae){% endif %}." ### Dependency review diff --git a/content/code-security/getting-started/securing-your-repository.md b/content/code-security/getting-started/securing-your-repository.md index e038d0cb4c..73b9c14c4a 100644 --- a/content/code-security/getting-started/securing-your-repository.md +++ b/content/code-security/getting-started/securing-your-repository.md @@ -123,7 +123,7 @@ You can set up {% data variables.product.prodname_code_scanning %} to automatica ## Configuring {% data variables.product.prodname_secret_scanning %} {% ifversion fpt %} -{% data variables.product.prodname_secret_scanning_partner_alerts_caps %} runs automatically on public repositories in all products on {% data variables.product.prodname_dotcom_the_website %}. {% data variables.product.prodname_secret_scanning_user_alerts_caps %} are available for public repositories, as well as repositories owned by organizations that use {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GH_advanced_security %}. {% data reusables.advanced-security.more-info-ghas %}{% endif %} +{% data variables.secret-scanning.partner_alerts_caps %} runs automatically on public repositories in all products on {% data variables.product.prodname_dotcom_the_website %}. {% data variables.secret-scanning.user_alerts_caps %} are available for public repositories, as well as repositories owned by organizations that use {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GH_advanced_security %}. {% data reusables.advanced-security.more-info-ghas %}{% endif %} {% ifversion ghec or ghes or ghae %} diff --git a/content/code-security/secret-scanning/about-secret-scanning.md b/content/code-security/secret-scanning/about-secret-scanning.md index 02d64356c4..8575b1dad2 100644 --- a/content/code-security/secret-scanning/about-secret-scanning.md +++ b/content/code-security/secret-scanning/about-secret-scanning.md @@ -31,15 +31,15 @@ If your project communicates with an external service, you might use a token or {% ifversion fpt or ghec %} {% data variables.product.prodname_secret_scanning_caps %} is available on {% data variables.product.prodname_dotcom_the_website %} in two forms: -1. **{% data variables.product.prodname_secret_scanning_partner_alerts_caps %}.** Runs automatically on all public repositories. Any strings that match patterns that were provided by secret scanning partners are reported directly to the relevant partner. For more information, see the "[About {% data variables.product.prodname_secret_scanning_partner_alerts %}](#about-secret-scanning-alerts-for-partners)" section below. +1. **{% data variables.secret-scanning.partner_alerts_caps %}.** Runs automatically on all public repositories. Any strings that match patterns that were provided by secret scanning partners are reported directly to the relevant partner. For more information, see the "[About {% data variables.secret-scanning.partner_alerts %}](#about-secret-scanning-alerts-for-partners)" section below. -2. **{% data variables.product.prodname_secret_scanning_user_alerts_caps %}.** {% ifversion fpt %}The following users can enable and configure additional scanning: +2. **{% data variables.secret-scanning.user_alerts_caps %}.** {% ifversion fpt %}The following users can enable and configure additional scanning: - Owners of repositories on {% data variables.product.prodname_dotcom_the_website %}, on any _public_ repositories they own. - Organizations owning _public_ repositories, on any of these repositories. - Organizations using {% data variables.product.prodname_ghe_cloud %} with a license for {% data variables.product.prodname_GH_advanced_security %}, on repositories owned by the organization, including _private_ and _internal_ repositories.{% elsif ghec %}You can enable and configure additional scanning for repositories owned by organizations that use {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GH_advanced_security %}. This includes private and internal repositories.{% endif %} {%- indented_data_reference reusables.secret-scanning.secret-scanning-alerts-beta %} - Any strings that match patterns provided by secret scanning partners, by other service providers, or defined by you or your organization, are reported as alerts in the "Security" tab of repositories. If a string in a public repository matches a partner pattern, it is also reported to the partner. For more information, see the "[About {% data variables.product.prodname_secret_scanning_user_alerts %}](#about-secret-scanning-alerts-for-users)" section below.{% endif %} + Any strings that match patterns provided by secret scanning partners, by other service providers, or defined by you or your organization, are reported as alerts in the "Security" tab of repositories. If a string in a public repository matches a partner pattern, it is also reported to the partner. For more information, see the "[About {% data variables.secret-scanning.user_alerts %}](#about-secret-scanning-alerts-for-users)" section below.{% endif %} Service providers can partner with {% data variables.product.company_short %} to provide their secret formats for scanning. {% data reusables.secret-scanning.partner-program-link %} @@ -51,7 +51,7 @@ You can also enable {% data variables.product.prodname_secret_scanning %} as a p {% endif %} {% ifversion fpt or ghec %} -## About {% data variables.product.prodname_secret_scanning_partner_alerts %} +## About {% data variables.secret-scanning.partner_alerts %} When you make a repository public, or push changes to a public repository, {% data variables.product.product_name %} always scans the code for secrets that match partner patterns. {% ifversion secret-scanning-issue-body-comments %}{% data reusables.secret-scanning.scan-issue-description-and-comments %}{% endif %} If {% data variables.product.prodname_secret_scanning %} detects a potential secret, we notify the service provider who issued the secret. The service provider validates the string and then decides whether they should revoke the secret, issue a new secret, or contact you directly. Their action will depend on the associated risks to you or them. For more information, see "[Supported secrets for partner alerts](/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-partner-alerts)." @@ -59,10 +59,10 @@ You cannot change the configuration of {% data variables.product.prodname_secret {% endif %} -## About {% data variables.product.prodname_secret_scanning_user_alerts %}{% ifversion ghes or ghae %} on {% data variables.product.product_name %}{% endif %} +## About {% data variables.secret-scanning.user_alerts %}{% ifversion ghes or ghae %} on {% data variables.product.product_name %}{% endif %} {% ifversion ghec or ghes or ghae %} -{% data variables.product.prodname_secret_scanning_user_alerts_caps %} {% ifversion ghec %}are{% else %}is{% endif %} available on all organization-owned repositories as part of {% data variables.product.prodname_GH_advanced_security %}. The feature is not available on user-owned repositories. {% endif %}{% ifversion fpt %}{% data variables.product.prodname_secret_scanning_user_alerts_caps %} are available for all public repositories.{% endif %} When you enable {% data variables.product.prodname_secret_scanning %} for a repository, {% data variables.product.prodname_dotcom %} scans the code for patterns that match secrets used by many service providers. {% ifversion secret-scanning-issue-body-comments %}{% data reusables.secret-scanning.scan-issue-description-and-comments %}{% endif %} When a supported secret is leaked, {% data variables.product.product_name %} generates a {% data variables.product.prodname_secret_scanning %} alert. {% ifversion secret-scanning-backfills %}{% data variables.product.prodname_dotcom %} will also periodically run a full git history scan of existing content in {% data variables.product.prodname_GH_advanced_security %} repositories where {% data variables.product.prodname_secret_scanning %} is enabled, and send alert notifications following the {% data variables.product.prodname_secret_scanning %} alert notification settings. {% endif %}For more information, see "{% ifversion fpt or ghec %}[Supported secrets for user alerts](/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-user-alerts){% else %}[{% data variables.product.prodname_secret_scanning_caps %} patterns](/code-security/secret-scanning/secret-scanning-patterns){% endif %}." +{% data variables.secret-scanning.user_alerts_caps %} {% ifversion ghec %}are{% else %}is{% endif %} available on all organization-owned repositories as part of {% data variables.product.prodname_GH_advanced_security %}. The feature is not available on user-owned repositories. {% endif %}{% ifversion fpt %}{% data variables.secret-scanning.user_alerts_caps %} are available for all public repositories.{% endif %} When you enable {% data variables.product.prodname_secret_scanning %} for a repository, {% data variables.product.prodname_dotcom %} scans the code for patterns that match secrets used by many service providers. {% ifversion secret-scanning-issue-body-comments %}{% data reusables.secret-scanning.scan-issue-description-and-comments %}{% endif %} When a supported secret is leaked, {% data variables.product.product_name %} generates a {% data variables.product.prodname_secret_scanning %} alert. {% ifversion secret-scanning-backfills %}{% data variables.product.prodname_dotcom %} will also periodically run a full git history scan of existing content in {% data variables.product.prodname_GH_advanced_security %} repositories where {% data variables.product.prodname_secret_scanning %} is enabled, and send alert notifications following the {% data variables.product.prodname_secret_scanning %} alert notification settings. {% endif %}For more information, see "{% ifversion fpt or ghec %}[Supported secrets for user alerts](/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-user-alerts){% else %}[{% data variables.product.prodname_secret_scanning_caps %} patterns](/code-security/secret-scanning/secret-scanning-patterns){% endif %}." {% ifversion secret-scanning-issue-body-comments %} {% note %} @@ -72,7 +72,7 @@ You cannot change the configuration of {% data variables.product.prodname_secret {% endnote %} {% endif %} -If you're a repository administrator, you can enable {% data variables.product.prodname_secret_scanning_user_alerts %} for any {% ifversion fpt %}public{% endif %} repository{% ifversion ghec or ghes > 3.4 or ghae > 3.4 %}, including archived repositories{% endif %}. Organization owners can also enable {% data variables.product.prodname_secret_scanning_user_alerts %} for all repositories or for all new repositories within an organization. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" and "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)." +If you're a repository administrator, you can enable {% data variables.secret-scanning.user_alerts %} for any {% ifversion fpt %}public{% endif %} repository{% ifversion ghec or ghes > 3.4 or ghae > 3.4 %}, including archived repositories{% endif %}. Organization owners can also enable {% data variables.secret-scanning.user_alerts %} for all repositories or for all new repositories within an organization. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" and "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)." {% ifversion ghes or ghae or ghec %}You can also define custom {% data variables.product.prodname_secret_scanning %} patterns for a repository, organization, or enterprise. For more information, see "[Defining custom patterns for {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/defining-custom-patterns-for-secret-scanning)." {% endif %} @@ -80,7 +80,7 @@ If you're a repository administrator, you can enable {% data variables.product.p {% ifversion secret-scanning-store-tokens %} {% data variables.product.company_short %} stores detected secrets using symmetric encryption, both in transit and at rest.{% endif %}{% ifversion ghes > 3.7 %} To rotate the encryption keys used for storing the detected secrets, you can contact {% data variables.contact.contact_ent_support %}.{% endif %} -### Accessing {% data variables.product.prodname_secret_scanning_alerts %} +### Accessing {% data variables.secret-scanning.alerts %} When you enable {% data variables.product.prodname_secret_scanning %} for a repository or push commits to a repository with {% data variables.product.prodname_secret_scanning %} enabled, {% data variables.product.prodname_dotcom %} scans the contents of those commits for secrets that match patterns defined by service providers{% ifversion ghes or ghae or ghec %} and any custom patterns defined in your enterprise, organization, or repository{% endif %}. {% ifversion secret-scanning-issue-body-comments %}{% data reusables.secret-scanning.scan-issue-description-and-comments %}{% endif %} {% ifversion secret-scanning-backfills %}{% data variables.product.prodname_dotcom %} also periodically runs a scan of all historical content in repositories with {% data variables.product.prodname_secret_scanning %} enabled.{% endif%} @@ -90,9 +90,9 @@ If {% data variables.product.prodname_secret_scanning %} detects a secret, {% da - If the contributor who committed the secret isn't ignoring the repository, {% data variables.product.prodname_dotcom %} will also send an email alert to the contributor. The emails contains a link to the related {% data variables.product.prodname_secret_scanning %} alert. The commit author can then view the alert in the repository, and resolve the alert. - {% data variables.product.prodname_dotcom %} displays an alert in the "Security" tab of the repository. -For more information about viewing and resolving {% data variables.product.prodname_secret_scanning_alerts %}, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/github/administering-a-repository/managing-alerts-from-secret-scanning)." +For more information about viewing and resolving {% data variables.secret-scanning.alerts %}, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/github/administering-a-repository/managing-alerts-from-secret-scanning)." -Repository administrators and organization owners can grant users and teams access to {% data variables.product.prodname_secret_scanning_alerts %}. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)." +Repository administrators and organization owners can grant users and teams access to {% data variables.secret-scanning.alerts %}. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)." {% ifversion ghec or ghes or ghae > 3.4 %} You can use the security overview to see an organization-level view of which repositories have enabled {% data variables.product.prodname_secret_scanning %} and the alerts found. For more information, see "[Viewing the security overview](/code-security/security-overview/viewing-the-security-overview)." diff --git a/content/code-security/secret-scanning/configuring-secret-scanning-for-your-repositories.md b/content/code-security/secret-scanning/configuring-secret-scanning-for-your-repositories.md index 1874b164c9..e2b80e4c0d 100644 --- a/content/code-security/secret-scanning/configuring-secret-scanning-for-your-repositories.md +++ b/content/code-security/secret-scanning/configuring-secret-scanning-for-your-repositories.md @@ -23,11 +23,11 @@ shortTitle: Configure secret scans {% data reusables.secret-scanning.beta %} {% data reusables.secret-scanning.enterprise-enable-secret-scanning %} -## Enabling {% data variables.product.prodname_secret_scanning_user_alerts %} +## Enabling {% data variables.secret-scanning.user_alerts %} {% data reusables.secret-scanning.secret-scanning-alerts-beta %} -You can enable {% data variables.product.prodname_secret_scanning_user_alerts %} for any {% ifversion fpt %}free public{% endif %} repository{% ifversion ghec or ghes or ghae %} that is owned by an organization{% else %} that you own{% endif %}. Once enabled, {% data reusables.secret-scanning.secret-scanning-process %} {% ifversion secret-scanning-issue-body-comments %}{% data reusables.secret-scanning.scan-issue-description-and-comments %} +You can enable {% data variables.secret-scanning.user_alerts %} for any {% ifversion fpt %}free public{% endif %} repository{% ifversion ghec or ghes or ghae %} that is owned by an organization{% else %} that you own{% endif %}. Once enabled, {% data reusables.secret-scanning.secret-scanning-process %} {% ifversion secret-scanning-issue-body-comments %}{% data reusables.secret-scanning.scan-issue-description-and-comments %} {% note %} @@ -69,7 +69,7 @@ You can enable {% data variables.product.prodname_secret_scanning_user_alerts %} ![Enable {% data variables.product.prodname_secret_scanning %} for your repository](/assets/images/enterprise/github-ae/repository/enable-secret-scanning-ghae.png) {% endif %} -## Excluding directories from {% data variables.product.prodname_secret_scanning_user_alerts %} +## Excluding directories from {% data variables.secret-scanning.user_alerts %} You can use a *secret_scanning.yml* file to exclude directories from {% data variables.product.prodname_secret_scanning %}. For example, you can exclude directories that contain tests or randomly generated content. diff --git a/content/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning.md b/content/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning.md index f3a8ea5c95..8aa76b5a31 100644 --- a/content/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning.md +++ b/content/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning.md @@ -65,7 +65,7 @@ Before defining a custom pattern, you must ensure that {% data variables.product ![Screenshot of custom pattern page with the button to enable push protection emphasized](/assets/images/help/repository/secret-scanning-custom-pattern-enable-push-protection.png){% endif %} -After your pattern is created, {% data reusables.secret-scanning.secret-scanning-process %} For more information on viewing {% data variables.product.prodname_secret_scanning_alerts %}, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." +After your pattern is created, {% data reusables.secret-scanning.secret-scanning-process %} For more information on viewing {% data variables.secret-scanning.alerts %}, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." ### Example of a custom pattern specified using additional requirements @@ -103,7 +103,7 @@ Before defining a custom pattern, you must ensure that you enable {% data variab {% ifversion ghes < 3.5 or ghae %} {% note %} -**Note:** As there is no dry-run functionality, we recommend that you test your custom patterns in a repository before defining them for your entire organization. That way, you can avoid creating excess false-positive {% data variables.product.prodname_secret_scanning_alerts %}. +**Note:** As there is no dry-run functionality, we recommend that you test your custom patterns in a repository before defining them for your entire organization. That way, you can avoid creating excess false-positive {% data variables.secret-scanning.alerts %}. {% endnote %} {% endif %} @@ -133,7 +133,7 @@ Before defining a custom pattern, you must ensure that you enable {% data variab ![Screenshot of custom pattern page with the button to enable push protection emphasized](/assets/images/help/repository/secret-scanning-custom-pattern-enable-push-protection.png){% endif %} -After your pattern is created, {% data variables.product.prodname_secret_scanning %} scans for any secrets in repositories in your organization, including their entire Git history on all branches. Organization owners and repository administrators will be alerted to any secrets found and can review the alert in the repository where the secret is found. For more information on viewing {% data variables.product.prodname_secret_scanning_alerts %}, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." +After your pattern is created, {% data variables.product.prodname_secret_scanning %} scans for any secrets in repositories in your organization, including their entire Git history on all branches. Organization owners and repository administrators will be alerted to any secrets found and can review the alert in the repository where the secret is found. For more information on viewing {% data variables.secret-scanning.alerts %}, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." ## Defining a custom pattern for an enterprise account @@ -150,7 +150,7 @@ Before defining a custom pattern, you must ensure that you enable secret scannin - At the enterprise level, only the creator of a custom pattern can edit the pattern, and use it in a dry run. - Enterprise owners can only make use of dry runs on repositories that they have access to, and enterprise owners do not necessarily have access to all the organizations or repositories within the enterprise. {% else %} -**Note:** As there is no dry-run functionality, we recommend that you test your custom patterns in a repository before defining them for your entire enterprise. That way, you can avoid creating excess false-positive {% data variables.product.prodname_secret_scanning_alerts %}. +**Note:** As there is no dry-run functionality, we recommend that you test your custom patterns in a repository before defining them for your entire enterprise. That way, you can avoid creating excess false-positive {% data variables.secret-scanning.alerts %}. {% endif %} @@ -172,11 +172,11 @@ Before defining a custom pattern, you must ensure that you enable secret scannin {%- endif %} {% data reusables.advanced-security.secret-scanning-create-custom-pattern %} -After your pattern is created, {% data variables.product.prodname_secret_scanning %} scans for any secrets in repositories within your enterprise's organizations with {% data variables.product.prodname_GH_advanced_security %} enabled, including their entire Git history on all branches. Organization owners and repository administrators will be alerted to any secrets found, and can review the alert in the repository where the secret is found. For more information on viewing {% data variables.product.prodname_secret_scanning_alerts %}, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." +After your pattern is created, {% data variables.product.prodname_secret_scanning %} scans for any secrets in repositories within your enterprise's organizations with {% data variables.product.prodname_GH_advanced_security %} enabled, including their entire Git history on all branches. Organization owners and repository administrators will be alerted to any secrets found, and can review the alert in the repository where the secret is found. For more information on viewing {% data variables.secret-scanning.alerts %}, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." ## Editing a custom pattern -When you save a change to a custom pattern, this closes all the {% data variables.product.prodname_secret_scanning_alerts %} that were created using the previous version of the pattern. +When you save a change to a custom pattern, this closes all the {% data variables.secret-scanning.alerts %} that were created using the previous version of the pattern. 1. Navigate to where the custom pattern was created. A custom pattern can be created in a repository, organization, or enterprise account. * For a repository or organization, display the "Security & analysis" settings for the repository or organization where the custom pattern was created. For more information, see "[Defining a custom pattern for a repository](#defining-a-custom-pattern-for-a-repository)" or "[Defining a custom pattern for an organization](#defining-a-custom-pattern-for-an-organization)" above. * For an enterprise, under "Policies" display the "Advanced Security" area, and then click **Security features**. For more information, see "[Defining a custom pattern for an enterprise account](#defining-a-custom-pattern-for-an-enterprise-account)" above. diff --git a/content/code-security/secret-scanning/managing-alerts-from-secret-scanning.md b/content/code-security/secret-scanning/managing-alerts-from-secret-scanning.md index ae39f4a8dd..ab16e8180c 100644 --- a/content/code-security/secret-scanning/managing-alerts-from-secret-scanning.md +++ b/content/code-security/secret-scanning/managing-alerts-from-secret-scanning.md @@ -23,12 +23,12 @@ shortTitle: Manage secret alerts {% data reusables.secret-scanning.beta %} {% data reusables.secret-scanning.secret-scanning-alerts-beta %} -## Managing {% data variables.product.prodname_secret_scanning_alerts%} +## Managing {% data variables.secret-scanning.alerts %} {% ifversion fpt or ghec %} {% note %} -**Note:** Alerts are created only for repositories with {% data variables.product.prodname_secret_scanning_user_alerts %} enabled. Secrets found in public repositories using the free {% data variables.product.prodname_secret_scanning_partner_alerts%} service are reported directly to the partner, without creating an alert. For more information, see "[Supported secrets for partner alerts](/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-partner-alerts)." +**Note:** Alerts are created only for repositories with {% data variables.secret-scanning.user_alerts %} enabled. Secrets found in public repositories using the free {% data variables.secret-scanning.partner_alerts %} service are reported directly to the partner, without creating an alert. For more information, see "[Supported secrets for partner alerts](/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-partner-alerts)." {% endnote %} {% endif %} @@ -90,7 +90,7 @@ Once a secret has been committed to a repository, you should consider the secret {% endnote %} {% endif %} -## Configuring notifications for {% data variables.product.prodname_secret_scanning_alerts %} +## Configuring notifications for {% data variables.secret-scanning.alerts %} When a new secret is detected, {% data variables.product.product_name %} notifies all users with access to security alerts for the repository according to their notification preferences. You will receive an email notification if you are watching the repository, have enabled notifications for security alerts or for all the activity on the repository, or are the author of the commit that contains the secret and are not ignoring the repository. diff --git a/content/code-security/secret-scanning/secret-scanning-patterns.md b/content/code-security/secret-scanning/secret-scanning-patterns.md index cf6adbcd71..e95f6bc629 100644 --- a/content/code-security/secret-scanning/secret-scanning-patterns.md +++ b/content/code-security/secret-scanning/secret-scanning-patterns.md @@ -24,16 +24,16 @@ redirect_from: {% data variables.product.product_name %} maintains these different sets of {% data variables.product.prodname_secret_scanning %} patterns: 1. **Partner patterns.** Used to detect potential secrets in all public repositories. For details, see "[Supported secrets for partner alerts](#supported-secrets-for-partner-alerts)." -2. **User alert patterns.** Used to detect potential secrets in {% ifversion fpt %}public{% endif %} repositories with {% data variables.product.prodname_secret_scanning_user_alerts %} enabled. For details, see "[Supported secrets for user alerts](#supported-secrets-for-user-alerts)."{% ifversion secret-scanning-push-protection %} +2. **User alert patterns.** Used to detect potential secrets in {% ifversion fpt %}public{% endif %} repositories with {% data variables.secret-scanning.user_alerts %} enabled. For details, see "[Supported secrets for user alerts](#supported-secrets-for-user-alerts)."{% ifversion secret-scanning-push-protection %} 3. **Push protection patterns.** Used to detect potential secrets in repositories with {% data variables.product.prodname_secret_scanning %} as a push protection enabled. For details, see "[Supported secrets for push protection](#supported-secrets-for-push-protection)."{% endif %} {% ifversion fpt %} -Owners of public repositories, as well as organizations using {% data variables.product.prodname_ghe_cloud %} with {% data variables.product.prodname_GH_advanced_security %}, can enable {% data variables.product.prodname_secret_scanning_user_alerts %} on their repositories. For details of these patterns, see the "[Supported secrets for user alerts](#supported-secrets-for-user-alerts) section below. +Owners of public repositories, as well as organizations using {% data variables.product.prodname_ghe_cloud %} with {% data variables.product.prodname_GH_advanced_security %}, can enable {% data variables.secret-scanning.user_alerts %} on their repositories. For details of these patterns, see the "[Supported secrets for user alerts](#supported-secrets-for-user-alerts) section below. {% endif %} ## Supported secrets for partner alerts -{% data variables.product.product_name %} currently scans public repositories for secrets issued by the following service providers and alerts the relevant service provider whenever a secret is detected in a commit. For more information about {% data variables.product.prodname_secret_scanning_partner_alerts %}, see "[About {% data variables.product.prodname_secret_scanning_partner_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-partners)." +{% data variables.product.product_name %} currently scans public repositories for secrets issued by the following service providers and alerts the relevant service provider whenever a secret is detected in a commit. For more information about {% data variables.secret-scanning.partner_alerts %}, see "[About {% data variables.secret-scanning.partner_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-partners)." {% data reusables.secret-scanning.secret-scanning-pattern-pair-matches %} @@ -44,7 +44,7 @@ Owners of public repositories, as well as organizations using {% data variables. {% data reusables.secret-scanning.secret-scanning-alerts-beta %} -When {% data variables.product.prodname_secret_scanning_user_alerts %} {% ifversion fpt or ghec %}are{% else %}is{% endif %} enabled, {% data variables.product.prodname_dotcom %} scans repositories for secrets issued by the following service providers and generates {% data variables.product.prodname_secret_scanning_alerts %}. You can see these alerts on the "Security" tab of the repository. {% ifversion fpt or ghec %}For more information about {% data variables.product.prodname_secret_scanning_user_alerts %}, see "[About {% data variables.product.prodname_secret_scanning_user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)."{% endif %} +When {% data variables.secret-scanning.user_alerts %} {% ifversion fpt or ghec %}are{% else %}is{% endif %} enabled, {% data variables.product.prodname_dotcom %} scans repositories for secrets issued by the following service providers and generates {% data variables.secret-scanning.alerts %}. You can see these alerts on the "Security" tab of the repository. {% ifversion fpt or ghec %}For more information about {% data variables.secret-scanning.user_alerts %}, see "[About {% data variables.secret-scanning.user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)."{% endif %} {% data reusables.secret-scanning.secret-scanning-pattern-pair-matches %} diff --git a/content/code-security/security-overview/about-the-security-overview.md b/content/code-security/security-overview/about-the-security-overview.md index 53626ada6f..07a5cfce34 100644 --- a/content/code-security/security-overview/about-the-security-overview.md +++ b/content/code-security/security-overview/about-the-security-overview.md @@ -38,14 +38,14 @@ The security overview shows which security features are enabled for repositories {% endif %} -For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies){% ifversion ghes or ghae %}" and{% elsif ghec %}," "[About {% data variables.product.prodname_secret_scanning_user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)" and{% endif %} "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)." +For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies){% ifversion ghes or ghae %}" and{% elsif ghec %}," "[About {% data variables.secret-scanning.user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)" and{% endif %} "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)." ## About filtering and sorting alerts The security overview provides a powerful way to understand the security of a group of repositories. The views are interactive with filters that allow you to drill into the aggregated data and identify sources of high risk or low feature coverage. As you apply multiple filters to focus on narrower areas of interest, the data across the view changes to reflect your selection. For more information, see "[Filtering alerts in the security overview](/code-security/security-overview/filtering-alerts-in-the-security-overview)." {% ifversion security-overview-alert-views %} -There are also dedicated views for each type of security alert that you can use to limit your analysis to a specific set of alerts, and then narrow the results further with a range of filters specific to each view. For example, in the {% data variables.product.prodname_secret_scanning %} alert view, you can use the `Secret type` filter to view only {% data variables.product.prodname_secret_scanning_alerts %} for a specific secret, like a GitHub {% data variables.product.pat_generic %}. +There are also dedicated views for each type of security alert that you can use to limit your analysis to a specific set of alerts, and then narrow the results further with a range of filters specific to each view. For example, in the {% data variables.product.prodname_secret_scanning %} alert view, you can use the `Secret type` filter to view only {% data variables.secret-scanning.alerts %} for a specific secret, like a GitHub {% data variables.product.pat_generic %}. {% endif %} {% note %} @@ -60,7 +60,7 @@ There are also dedicated views for each type of security alert that you can use You can find the security overview on the **Security** tab for any organization that's owned by an enterprise. Each view shows aggregated data that you can drill down into, as you add each filter, the data is updated to reflect the repositories or alerts that you've selected. -The application security team at your company can use the different views for both broad and specific analyses of your organization's security status. {% ifversion security-overview-org-risk-coverage %}For example, the team can use the "Security Coverage" page to monitor the adoption of features across your organization or by a specific team as you rollout {% data variables.product.prodname_GH_advanced_security %}, or use the "Security Risk" page to identify repositories with more than five open {% data variables.product.prodname_secret_scanning_alerts %}.{% else %}For example, they can use the overview page to monitor adoption of features by your organization or by a specific team as you rollout {% data variables.product.prodname_GH_advanced_security %} to your enterprise, or to review all alerts of a specific type and severity level across all repositories in your organization.{% endif %} +The application security team at your company can use the different views for both broad and specific analyses of your organization's security status. {% ifversion security-overview-org-risk-coverage %}For example, the team can use the "Security Coverage" page to monitor the adoption of features across your organization or by a specific team as you rollout {% data variables.product.prodname_GH_advanced_security %}, or use the "Security Risk" page to identify repositories with more than five open {% data variables.secret-scanning.alerts %}.{% else %}For example, they can use the overview page to monitor adoption of features by your organization or by a specific team as you rollout {% data variables.product.prodname_GH_advanced_security %} to your enterprise, or to review all alerts of a specific type and severity level across all repositories in your organization.{% endif %} Organization owners and security managers for organizations have access to the security overview for their organizations. {% ifversion ghec or ghes > 3.6 or ghae > 3.6 %}Organization members can also access the organization-level security overview to view results for repositories where they have admin privileges or have been granted access to security alerts. For more information on managing security alert access, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."{% endif %} diff --git a/content/code-security/security-overview/filtering-alerts-in-the-security-overview.md b/content/code-security/security-overview/filtering-alerts-in-the-security-overview.md index 25dd3bd6d4..48e8745d50 100644 --- a/content/code-security/security-overview/filtering-alerts-in-the-security-overview.md +++ b/content/code-security/security-overview/filtering-alerts-in-the-security-overview.md @@ -46,7 +46,7 @@ In the examples below, replace `:enabled` with `:not-enabled` to see repositorie | -------- | -------- | | `code-scanning:enabled` | Display repositories that have set up {% data variables.product.prodname_code_scanning %}. | | `dependabot:enabled` | Display repositories that have enabled {% data variables.product.prodname_dependabot_alerts %}. | -| `secret-scanning:enabled` | Display repositories that have enabled {% data variables.product.prodname_secret_scanning_alerts %}. {% ifversion security-overview-org-risk-coverage %} | +| `secret-scanning:enabled` | Display repositories that have enabled {% data variables.secret-scanning.alerts %}. {% ifversion security-overview-org-risk-coverage %} | | `any-feature:enabled` | Display repositories where at least one security feature is enabled. |{% else %} | `not-enabled:any` | Display repositories with at least one security feature that is not enabled. |{% endif %} @@ -101,7 +101,7 @@ These qualifiers are available in the enterprise-level view. | Qualifier | Description | | -------- | -------- | | code-scanning:n | Display repositories that have *n* {% data variables.product.prodname_code_scanning %} alerts. This qualifier can use `=`, `>` and `<` comparison operators. | -| secret-scanning:n | Display repositories that have *n* {% data variables.product.prodname_secret_scanning_alerts %}. This qualifier can use `=`, `>` and `<` comparison operators. | +| secret-scanning:n | Display repositories that have *n* {% data variables.secret-scanning.alerts %}. This qualifier can use `=`, `>` and `<` comparison operators. | | dependabot:n | Display repositories that have *n* {% data variables.product.prodname_dependabot_alerts %}. This qualifier can use `=`, `>` and `<` comparison operators. | diff --git a/content/code-security/supply-chain-security/end-to-end-supply-chain/securing-code.md b/content/code-security/supply-chain-security/end-to-end-supply-chain/securing-code.md index bd799d03bd..de08beec0c 100644 --- a/content/code-security/supply-chain-security/end-to-end-supply-chain/securing-code.md +++ b/content/code-security/supply-chain-security/end-to-end-supply-chain/securing-code.md @@ -77,7 +77,7 @@ Code often needs to communicate with other systems over a network, and requires {% data reusables.secret-scanning.enterprise-enable-secret-scanning %} {% ifversion fpt or ghec %} -{% data variables.product.prodname_dotcom %} partners with many providers to automatically detect when secrets are committed to or stored in your public repositories, and will notify the provider so they can take appropriate actions to ensure your account remains secure. For more information, see "[About {% data variables.product.prodname_secret_scanning_partner_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-partners)." +{% data variables.product.prodname_dotcom %} partners with many providers to automatically detect when secrets are committed to or stored in your public repositories, and will notify the provider so they can take appropriate actions to ensure your account remains secure. For more information, see "[About {% data variables.secret-scanning.partner_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-partners)." {% endif %} {% ifversion fpt %} @@ -86,7 +86,7 @@ You can can enable and configure additional scanning that will alert you about a - an organization using {% data variables.product.prodname_ghe_cloud %} with a license for {% data variables.product.prodname_GH_advanced_security %}. {% data variables.product.prodname_secret_scanning_caps %} will also analyze your private repositories. {% elsif ghec %} -Additionally, if your organization uses {% data variables.product.prodname_GH_advanced_security %}, you can enable {% data variables.product.prodname_secret_scanning_user_alerts %} on any repository owned by the organization, including private repositories. You can also define custom patterns to detect additional secrets at the repository, organization, or enterprise level. For more information, see "[About {% data variables.product.prodname_secret_scanning_user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)." +Additionally, if your organization uses {% data variables.product.prodname_GH_advanced_security %}, you can enable {% data variables.secret-scanning.user_alerts %} on any repository owned by the organization, including private repositories. You can also define custom patterns to detect additional secrets at the repository, organization, or enterprise level. For more information, see "[About {% data variables.secret-scanning.user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)." {% else %} You can configure {% data variables.product.prodname_secret_scanning %} to check for secrets issued by many service providers and to notify you when any are detected. You can also define custom patterns to detect additional secrets at the repository, organization, or enterprise level. For more information, see "[About secret scanning](/code-security/secret-scanning/about-secret-scanning)" and "[Secret scanning patterns](/code-security/secret-scanning/secret-scanning-patterns)." {% endif %} diff --git a/content/get-started/learning-about-github/about-github-advanced-security.md b/content/get-started/learning-about-github/about-github-advanced-security.md index 3b6322a5f0..02c53793e8 100644 --- a/content/get-started/learning-about-github/about-github-advanced-security.md +++ b/content/get-started/learning-about-github/about-github-advanced-security.md @@ -26,7 +26,7 @@ A {% data variables.product.prodname_GH_advanced_security %} license provides th - **{% data variables.product.prodname_code_scanning_capc %}** - Search for potential security vulnerabilities and coding errors in your code. For more information, see "[About {% data variables.product.prodname_code_scanning %}](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning)." -- **{% data variables.product.prodname_secret_scanning_caps %}** - Detect secrets, for example keys and tokens, that have been checked into {% ifversion fpt %} private repositories{% else %} the repository{% endif %}. {% ifversion fpt%}{% data variables.product.prodname_secret_scanning_user_alerts_caps %} and {% data variables.product.prodname_secret_scanning_partner_alerts %} are available and free of charge for public repositories on {% data variables.product.prodname_dotcom_the_website %}.{% endif %}{% ifversion secret-scanning-push-protection %} If push protection is enabled, also detects secrets when they are pushed to your repository. For more information, see "[About {% data variables.product.prodname_secret_scanning %}](/code-security/secret-scanning/about-secret-scanning)" and "[Protecting pushes with {% data variables.product.prodname_secret_scanning %}](/code-security/secret-scanning/protecting-pushes-with-secret-scanning)."{% else %} For more information, see "[About {% data variables.product.prodname_secret_scanning %}](/code-security/secret-scanning/about-secret-scanning)."{% endif %} +- **{% data variables.product.prodname_secret_scanning_caps %}** - Detect secrets, for example keys and tokens, that have been checked into {% ifversion fpt %} private repositories{% else %} the repository{% endif %}. {% ifversion fpt%}{% data variables.secret-scanning.user_alerts_caps %} and {% data variables.secret-scanning.partner_alerts %} are available and free of charge for public repositories on {% data variables.product.prodname_dotcom_the_website %}.{% endif %}{% ifversion secret-scanning-push-protection %} If push protection is enabled, also detects secrets when they are pushed to your repository. For more information, see "[About {% data variables.product.prodname_secret_scanning %}](/code-security/secret-scanning/about-secret-scanning)" and "[Protecting pushes with {% data variables.product.prodname_secret_scanning %}](/code-security/secret-scanning/protecting-pushes-with-secret-scanning)."{% else %} For more information, see "[About {% data variables.product.prodname_secret_scanning %}](/code-security/secret-scanning/about-secret-scanning)."{% endif %} - **Dependency review** - Show the full impact of changes to dependencies and see details of any vulnerable versions before you merge a pull request. For more information, see "[About dependency review](/code-security/supply-chain-security/about-dependency-review)." diff --git a/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md b/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md index cc5e311d8e..22c69a6bf7 100644 --- a/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md +++ b/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md @@ -48,7 +48,7 @@ You can enable or disable features for all repositories. - **{% data variables.product.prodname_dependabot_security_updates %}** - Your changes affect all repositories. {%- ifversion ghec %} - **{% data variables.product.prodname_GH_advanced_security %}** - Your changes affect only private repositories because {% data variables.product.prodname_GH_advanced_security %} and the related features are always enabled for public repositories. -- **{% data variables.product.prodname_secret_scanning_caps %}** - Your changes affect repositories where {% data variables.product.prodname_GH_advanced_security %} is also enabled. This option controls whether or not {% data variables.product.prodname_secret_scanning_user_alerts %} are enabled. {% data variables.product.prodname_secret_scanning_partner_alerts_caps %} always runs on all public repositories. +- **{% data variables.product.prodname_secret_scanning_caps %}** - Your changes affect repositories where {% data variables.product.prodname_GH_advanced_security %} is also enabled. This option controls whether or not {% data variables.secret-scanning.user_alerts %} are enabled. {% data variables.secret-scanning.partner_alerts_caps %} always runs on all public repositories. {% endif %} {% endif %} diff --git a/content/organizations/managing-user-access-to-your-organizations-repositories/repository-roles-for-an-organization.md b/content/organizations/managing-user-access-to-your-organizations-repositories/repository-roles-for-an-organization.md index 30feb57a7e..ff832f052e 100644 --- a/content/organizations/managing-user-access-to-your-organizations-repositories/repository-roles-for-an-organization.md +++ b/content/organizations/managing-user-access-to-your-organizations-repositories/repository-roles-for-an-organization.md @@ -163,9 +163,9 @@ In this section, you can find the access required for security features, such as | [View dependency reviews](/code-security/supply-chain-security/about-dependency-review) | **✔️** | **✔️** | **✔️** | **✔️** | **✔️** |{% endif %} | [View {% data variables.product.prodname_code_scanning %} alerts on pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests) | **✔️** | **✔️** | **✔️** | **✔️** | **✔️** | | [List, dismiss, and delete {% data variables.product.prodname_code_scanning %} alerts](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository) | | | **✔️** | **✔️** | **✔️** | -| [View and dismiss {% data variables.product.prodname_secret_scanning_alerts %} in a repository](/github/administering-a-repository/managing-alerts-from-secret-scanning) | | | **✔️**{% ifversion not ghae %}[1]{% endif %} | **✔️**{% ifversion not ghae %}[1]{% endif %} | **✔️** |{% ifversion ghes or ghae or ghec %} -| [Resolve, revoke, or re-open {% data variables.product.prodname_secret_scanning_alerts %}](/github/administering-a-repository/managing-alerts-from-secret-scanning) | | | **✔️**{% ifversion not ghae %}[1]{% endif %} | **✔️**{% ifversion not ghae %}[1]{% endif %} | **✔️** |{% endif %}{% ifversion ghes or ghae or ghec %} -| [Designate additional people or teams to receive {% data variables.product.prodname_secret_scanning_alerts %}](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts) in repositories | | | | | **✔️** |{% endif %} +| [View and dismiss {% data variables.secret-scanning.alerts %} in a repository](/github/administering-a-repository/managing-alerts-from-secret-scanning) | | | **✔️**{% ifversion not ghae %}[1]{% endif %} | **✔️**{% ifversion not ghae %}[1]{% endif %} | **✔️** |{% ifversion ghes or ghae or ghec %} +| [Resolve, revoke, or re-open {% data variables.secret-scanning.alerts %}](/github/administering-a-repository/managing-alerts-from-secret-scanning) | | | **✔️**{% ifversion not ghae %}[1]{% endif %} | **✔️**{% ifversion not ghae %}[1]{% endif %} | **✔️** |{% endif %}{% ifversion ghes or ghae or ghec %} +| [Designate additional people or teams to receive {% data variables.secret-scanning.alerts %}](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts) in repositories | | | | | **✔️** |{% endif %} [1] Repository writers and maintainers can only see alert information for their own commits. diff --git a/content/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository.md b/content/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository.md index 2130b4e01b..f067139212 100644 --- a/content/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository.md +++ b/content/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository.md @@ -27,7 +27,7 @@ shortTitle: Security & analysis {% ifversion fpt or ghec %} ## Enabling or disabling security and analysis features for public repositories -You can manage a subset of security and analysis features for public repositories. Other features are permanently enabled, including dependency graph and {% data variables.product.prodname_secret_scanning_partner_alerts %}. +You can manage a subset of security and analysis features for public repositories. Other features are permanently enabled, including dependency graph and {% data variables.secret-scanning.partner_alerts %}. {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-settings %} @@ -56,7 +56,7 @@ You can manage the security and analysis features for your {% ifversion fpt or g {% ifversion not fpt %} {% note %} - **Note:** If you disable {% data variables.product.prodname_GH_advanced_security %}, {% ifversion ghec %}dependency review, {% endif %}{% data variables.product.prodname_secret_scanning_user_alerts %} and {% data variables.product.prodname_code_scanning %} are disabled. Any workflows, SARIF uploads, or API calls for {% data variables.product.prodname_code_scanning %} will fail. + **Note:** If you disable {% data variables.product.prodname_GH_advanced_security %}, {% ifversion ghec %}dependency review, {% endif %}{% data variables.secret-scanning.user_alerts %} and {% data variables.product.prodname_code_scanning %} are disabled. Any workflows, SARIF uploads, or API calls for {% data variables.product.prodname_code_scanning %} will fail. {% endnote %}{% endif %} {% endif %} @@ -72,7 +72,7 @@ Security alerts for a repository are visible to people with admin access to the {% note %} -Organization owners and repository administrators can only grant access to view security alerts, such as {% data variables.product.prodname_secret_scanning_alerts %}, to people or teams who have write access to the repo. +Organization owners and repository administrators can only grant access to view security alerts, such as {% data variables.secret-scanning.alerts %}, to people or teams who have write access to the repo. {% endnote %} diff --git a/content/rest/secret-scanning.md b/content/rest/secret-scanning.md index e3b740f3e9..d294f93d97 100644 --- a/content/rest/secret-scanning.md +++ b/content/rest/secret-scanning.md @@ -20,6 +20,6 @@ redirect_from: The {% data variables.product.prodname_secret_scanning %} API lets you: - Enable or disable {% data variables.product.prodname_secret_scanning %}{% ifversion secret-scanning-push-protection %} and push protection{% endif %} for a repository. For more information, see "[Repositories](/rest/repos/repos#update-a-repository)" and expand the "Properties of the `security_and_analysis` object" section in the REST API documentation. -- Retrieve and update {% data variables.product.prodname_secret_scanning_alerts %} from a repository. For further details, see the sections below. +- Retrieve and update {% data variables.secret-scanning.alerts %} from a repository. For further details, see the sections below. For more information about {% data variables.product.prodname_secret_scanning %}, see "[About {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/about-secret-scanning)." diff --git a/data/reusables/advanced-security/more-info-ghas-secret-scanning.md b/data/reusables/advanced-security/more-info-ghas-secret-scanning.md index d1d089d007..ad5d41b2a4 100644 --- a/data/reusables/advanced-security/more-info-ghas-secret-scanning.md +++ b/data/reusables/advanced-security/more-info-ghas-secret-scanning.md @@ -1 +1 @@ -For more information, see {% ifversion fpt or ghec %}"[About {% data variables.product.prodname_secret_scanning_user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)"{% elsif ghes %}"[About {% data variables.product.prodname_secret_scanning_user_alerts %} on {% data variables.product.product_name %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-on-github-enterprise-server)"{% endif %} and "[About {% data variables.product.prodname_GH_advanced_security %}](/github/getting-started-with-github/about-github-advanced-security)." +For more information, see {% ifversion fpt or ghec %}"[About {% data variables.secret-scanning.user_alerts %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-users)"{% elsif ghes %}"[About {% data variables.secret-scanning.user_alerts %} on {% data variables.product.product_name %}](/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-on-github-enterprise-server)"{% endif %} and "[About {% data variables.product.prodname_GH_advanced_security %}](/github/getting-started-with-github/about-github-advanced-security)." diff --git a/data/reusables/gated-features/secret-scanning.md b/data/reusables/gated-features/secret-scanning.md index 249553b09d..beb6c5e479 100644 --- a/data/reusables/gated-features/secret-scanning.md +++ b/data/reusables/gated-features/secret-scanning.md @@ -1,8 +1,8 @@ {%- ifversion fpt %} -{% data variables.product.prodname_secret_scanning_partner_alerts_caps %} run automatically on public repositories in all products on {% data variables.product.prodname_dotcom_the_website %}. {% data variables.product.prodname_secret_scanning_user_alerts_caps %} are available for public repositories, as well as repositories owned by organizations that use {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GH_advanced_security %}. +{% data variables.secret-scanning.partner_alerts_caps %} run automatically on public repositories in all products on {% data variables.product.prodname_dotcom_the_website %}. {% data variables.secret-scanning.user_alerts_caps %} are available for public repositories, as well as repositories owned by organizations that use {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GH_advanced_security %}. {%- elsif ghec %} -{% data variables.product.prodname_secret_scanning_partner_alerts_caps %} run automatically on all public repositories. If you have a license for {% data variables.product.prodname_GH_advanced_security %}, you can enable and configure {% data variables.product.prodname_secret_scanning_user_alerts %} for any repository owned by an organization. +{% data variables.secret-scanning.partner_alerts_caps %} run automatically on all public repositories. If you have a license for {% data variables.product.prodname_GH_advanced_security %}, you can enable and configure {% data variables.secret-scanning.user_alerts %} for any repository owned by an organization. {%- elsif ghes %} {% data variables.product.prodname_secret_scanning_caps %} is available for organization-owned repositories in {% data variables.product.product_name %} if your enterprise has a license for {% data variables.product.prodname_GH_advanced_security %}. diff --git a/data/reusables/secret-scanning/secret-scanning-alerts-beta.md b/data/reusables/secret-scanning/secret-scanning-alerts-beta.md index 5e4c021cff..652c3f8261 100644 --- a/data/reusables/secret-scanning/secret-scanning-alerts-beta.md +++ b/data/reusables/secret-scanning/secret-scanning-alerts-beta.md @@ -2,7 +2,7 @@ {% note %} -**Note:** The {% data variables.product.prodname_secret_scanning_user_alerts %} feature is available as a beta for users on {% data variables.product.prodname_free_user %}, {% data variables.product.prodname_pro %}, or {% data variables.product.prodname_team %} plans and is subject to change. +**Note:** The {% data variables.secret-scanning.user_alerts %} feature is available as a beta for users on {% data variables.product.prodname_free_user %}, {% data variables.product.prodname_pro %}, or {% data variables.product.prodname_team %} plans and is subject to change. {% endnote %} {% endif %} \ No newline at end of file diff --git a/data/variables/product.yml b/data/variables/product.yml index 46d4b6df89..cd2e02fa53 100644 --- a/data/variables/product.yml +++ b/data/variables/product.yml @@ -185,13 +185,7 @@ prodname_advisory_database: 'GitHub Advisory Database' # Secret scanning prodname_secret_scanning: 'secret scanning' # Overall feature name and name for GHES and GHAE prodname_secret_scanning_caps: 'Secret scanning' -prodname_secret_scanning_partner_alerts: 'secret scanning alerts for partners' # GitHub.com feature for public repos only -prodname_secret_scanning_partner_alerts_caps: 'Secret scanning alerts for partners' -prodname_secret_scanning_user_alerts: >- - {% ifversion fpt or ghec %}secret scanning alerts for users{% else %}secret scanning{% endif %} -prodname_secret_scanning_user_alerts_caps: >- - {% ifversion fpt or ghec %}Secret scanning alerts for users{% else %}Secret scanning{% endif %} -prodname_secret_scanning_alerts: 'secret scanning alerts' + # Code scanning prodname_code_scanning: 'code scanning' prodname_code_scanning_capc: 'Code scanning' diff --git a/data/variables/secret-scanning.yml b/data/variables/secret-scanning.yml new file mode 100644 index 0000000000..59d9a0a8b0 --- /dev/null +++ b/data/variables/secret-scanning.yml @@ -0,0 +1,9 @@ +# Variables used in secret scanning that are not product names + +partner_alerts: 'secret scanning alerts for partners' # GitHub.com feature for public repos only +partner_alerts_caps: 'Secret scanning alerts for partners' +user_alerts: >- + {% ifversion fpt or ghec %}secret scanning alerts for users{% else %}secret scanning{% endif %} +user_alerts_caps: >- + {% ifversion fpt or ghec %}Secret scanning alerts for users{% else %}Secret scanning{% endif %} +alerts: 'secret scanning alerts'