88 lines
7.5 KiB
Markdown
88 lines
7.5 KiB
Markdown
---
|
|
title: About secret scanning
|
|
intro: '{% data variables.product.product_name %} scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally.'
|
|
product: '{% data reusables.gated-features.secret-scanning %}'
|
|
redirect_from:
|
|
- /github/administering-a-repository/about-token-scanning
|
|
- /articles/about-token-scanning
|
|
- /articles/about-token-scanning-for-private-repositories
|
|
- /github/administering-a-repository/about-secret-scanning
|
|
versions:
|
|
fpt: '*'
|
|
ghes: '>=3.0'
|
|
ghae: '*'
|
|
type: overview
|
|
topics:
|
|
- Secret scanning
|
|
- Advanced Security
|
|
---
|
|
|
|
{% data reusables.secret-scanning.beta %}
|
|
{% data reusables.secret-scanning.enterprise-enable-secret-scanning %}
|
|
|
|
If your project communicates with an external service, you might use a token or private key for authentication. Tokens and private keys are examples of secrets that a service provider can issue. If you check a secret into a repository, anyone who has read access to the repository can use the secret to access the external service with your privileges. We recommend that you store secrets in a dedicated, secure location outside of the repository for your project.
|
|
|
|
{% data variables.product.prodname_secret_scanning_caps %} will scan your entire Git history on all branches present in your {% data variables.product.prodname_dotcom %} repository for any secrets. Service providers can partner with {% data variables.product.company_short %} to provide their secret formats for scanning.{% ifversion fpt %} For more information, see "[Secret scanning partner program](/developers/overview/secret-scanning-partner-program)."
|
|
{% endif %}
|
|
|
|
{% data reusables.secret-scanning.about-secret-scanning %}
|
|
|
|
{% ifversion fpt %}
|
|
## About {% data variables.product.prodname_secret_scanning %} for public repositories
|
|
|
|
{% data variables.product.prodname_secret_scanning_caps %} is automatically enabled on public repositories. When you push to a public repository, {% data variables.product.product_name %} scans the content of the commits for secrets. If you switch a private repository to public, {% data variables.product.product_name %} scans the entire repository for secrets.
|
|
|
|
When {% data variables.product.prodname_secret_scanning %} detects a set of credentials, we notify the service provider who issued the secret. The service provider validates the credential and then decides whether they should revoke the secret, issue a new secret, or reach out to you directly, which will depend on the associated risks to you or the service provider. For an overview of how we work with token-issuing partners, see "[Secret scanning partner program](/developers/overview/secret-scanning-partner-program)."
|
|
|
|
{% data variables.product.product_name %} currently scans public repositories for secrets issued by the following service providers.
|
|
|
|
{% data reusables.secret-scanning.partner-secret-list-public-repo %}
|
|
|
|
## About {% data variables.product.prodname_secret_scanning %} for private repositories
|
|
{% endif %}
|
|
|
|
{% ifversion ghes > 2.22 or ghae %}
|
|
## About {% data variables.product.prodname_secret_scanning %} on {% data variables.product.product_name %}
|
|
|
|
{% data variables.product.prodname_secret_scanning_caps %} is available on all organization-owned repositories as part of {% data variables.product.prodname_GH_advanced_security %}. It is not available on user-owned repositories.
|
|
{% endif %}
|
|
|
|
If you're a repository administrator or an organization owner, you can enable {% data variables.product.prodname_secret_scanning %} for {% ifversion fpt %} private{% endif %} repositories that are owned by organizations. You can enable {% data variables.product.prodname_secret_scanning %} for all your repositories, or for all new repositories within your organization.{% ifversion fpt %} {% data variables.product.prodname_secret_scanning_caps %} is not available for user-owned private repositories.{% endif %} For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" and "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)."
|
|
|
|
{% ifversion fpt or ghes > 3.1 or ghae-next %}You can also define custom {% data variables.product.prodname_secret_scanning %} patterns that only apply to your repository or organization. For more information, see "[Defining custom patterns for {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/defining-custom-patterns-for-secret-scanning)."{% endif %}
|
|
|
|
When you push commits to a{% ifversion fpt %} private{% endif %} repository with {% data variables.product.prodname_secret_scanning %} enabled, {% data variables.product.prodname_dotcom %} scans the contents of the commits for secrets.
|
|
|
|
When {% data variables.product.prodname_secret_scanning %} detects a secret in a{% ifversion fpt %} private{% endif %} repository, {% data variables.product.prodname_dotcom %} generates an alert.
|
|
|
|
- {% data variables.product.prodname_dotcom %} sends an email alert to the repository administrators and organization owners.
|
|
{% ifversion fpt or ghes > 3.0 or ghae-next %}
|
|
- {% data variables.product.prodname_dotcom %} sends an email alert to the contributor who committed the secret to the repository, with a link to the related {% data variables.product.prodname_secret_scanning %} alert. The commit author can then view the alert in the repository, and resolve the alert.
|
|
{% endif %}
|
|
- {% data variables.product.prodname_dotcom %} displays an alert in the repository.{% ifversion ghes = 3.0 %} For more information, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/github/administering-a-repository/managing-alerts-from-secret-scanning)."{% endif %}
|
|
|
|
{% ifversion fpt or ghes > 3.0 or ghae-next %}
|
|
For more information about viewing and resolving {% data variables.product.prodname_secret_scanning %} alerts, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/github/administering-a-repository/managing-alerts-from-secret-scanning)."{% endif %}
|
|
|
|
Repository administrators and organization owners can grant users and teams access to {% data variables.product.prodname_secret_scanning %} alerts. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)."
|
|
|
|
{% ifversion fpt or ghes > 3.0 %}
|
|
To monitor results from {% data variables.product.prodname_secret_scanning %} across your private repositories or your organization, you can use the {% data variables.product.prodname_secret_scanning %} API. For more information about API endpoints, see "[{% data variables.product.prodname_secret_scanning_caps %}](/rest/reference/secret-scanning)."{% endif %}
|
|
|
|
{% data variables.product.prodname_dotcom %} currently scans{% ifversion fpt %} private{% endif %} repositories for secrets issued by the following service providers.
|
|
|
|
{% data reusables.secret-scanning.partner-secret-list-private-repo %}
|
|
|
|
{% ifversion ghes < 3.2 or ghae %}
|
|
{% note %}
|
|
|
|
**Note:** {% data variables.product.prodname_secret_scanning_caps %} does not currently allow you to define your own patterns for detecting secrets.
|
|
|
|
{% endnote %}
|
|
{% endif %}
|
|
|
|
## Further reading
|
|
|
|
- "[Securing your repository](/code-security/getting-started/securing-your-repository)"
|
|
- "[Keeping your account and data secure](/github/authenticating-to-github/keeping-your-account-and-data-secure)"
|