docs/content/code-security/secret-security/configuring-secret-scanning-for-your-repositories.md

title, intro, permissions, redirect_from, product, versions, topics

title	intro	permissions	redirect_from	product	versions	topics
Configuring secret scanning for your repositories	You can configure how {% data variables.product.prodname_dotcom %} scans your repositories for secrets.	People with admin permissions to a repository can enable {% data variables.product.prodname_secret_scanning %} for the repository.	/github/administering-a-repository/configuring-secret-scanning-for-private-repositories /github/administering-a-repository/configuring-secret-scanning-for-your-repositories	{% data reusables.gated-features.secret-scanning %}	free-pro-team enterprise-server github-ae * >=3.0 *	Repositories

{% data reusables.secret-scanning.beta %} {% data reusables.secret-scanning.enterprise-enable-secret-scanning %}

{% if currentVersion == "free-pro-team@latest" %} {% note %}

Note: {% data variables.product.prodname_secret_scanning_caps %} is enabled by default on public repositories and cannot be turned off. You can configure {% data variables.product.prodname_secret_scanning %} for your private repositories only.

{% endnote %} {% endif %}

Enabling {% data variables.product.prodname_secret_scanning %} for {% if currentVersion == "free-pro-team@latest" %}private {% endif %}repositories

{% if currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@next" %} You can enable {% data variables.product.prodname_secret_scanning %} for any repository that is owned by an organization. {% endif %}

{% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-settings %} {% data reusables.repositories.navigate-to-security-and-analysis %} {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next"%} 4. If {% data variables.product.prodname_advanced_security %} is not already enabled for the repository, to the right of "{% data variables.product.prodname_GH_advanced_security %}", click Enable. {% if currentVersion == "free-pro-team@latest" %} {% elsif currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}{% endif %} 5. Review the impact of enabling {% data variables.product.prodname_advanced_security %}, then click Enable {% data variables.product.prodname_GH_advanced_security %} for this repository. 6. When you enable {% data variables.product.prodname_advanced_security %}, {% data variables.product.prodname_secret_scanning %} may automatically be enabled for the repository due to the organization's settings. If "{% data variables.product.prodname_secret_scanning_caps %}" is shown with an Enable button, you still need to enable {% data variables.product.prodname_secret_scanning %} by clicking Enable. If you see a Disable button, {% data variables.product.prodname_secret_scanning %} is already enabled. {% elsif currentVersion == "enterprise-server@3.0" %} 7. To the right of "{% data variables.product.prodname_secret_scanning_caps %}", click Enable. {% endif %} {% if currentVersion == "github-ae@latest" %}

1. Before you can enable {% data variables.product.prodname_secret_scanning %}, you need to enable {% data variables.product.prodname_GH_advanced_security %} first. To the right of "{% data variables.product.prodname_GH_advanced_security %}", click Enable.
2. Click Enable {% data variables.product.prodname_GH_advanced_security %} for this repository to confirm the action.
3. To the right of "{% data variables.product.prodname_secret_scanning_caps %}", click Enable. {% endif %}

Excluding alerts from {% data variables.product.prodname_secret_scanning %} in {% if currentVersion == "free-pro-team@latest" %}private {% endif %}repositories

You can use a secret_scanning.yml file to exclude directories from {% data variables.product.prodname_secret_scanning %}. For example, you can exclude directories that contain tests or randomly generated content.

{% data reusables.repositories.navigate-to-repo %} {% data reusables.files.add-file %} 3. In the file name field, type .github/secret_scanning.yml. 4. Under Edit new file, type paths-ignore: followed by the paths you want to exclude from {% data variables.product.prodname_secret_scanning %}. yaml paths-ignore: - "foo/bar/*.js"

You can use special characters, such as `*` to filter paths. For more information about filter patterns, see "[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet)."

{% note %}

**Notes:**
- If there are more than 1,000 entries in `paths-ignore`, {% data variables.product.prodname_secret_scanning %} will only exclude the first 1,000 directories from scans.
- If *secret_scanning.yml* is larger than 1 MB, {% data variables.product.prodname_secret_scanning %} will ignore the entire file.

{% endnote %}

You can also ignore individual alerts from {% data variables.product.prodname_secret_scanning %}. For more information, see "Managing alerts from {% data variables.product.prodname_secret_scanning %}."

Further reading

• "Managing security and analysis settings for your organization"