secret-scanning

Name: secret-scanning
Author: github

3.9kinstalls4.6kforks

How to install secret-scanning?

github/awesome-copilot/secret-scanning

$npx -y skills add github/awesome-copilot --skill secret-scanning

Installs into the current project.

Summary

Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-

Files · 1

View on GitHub

SKILL.md

1	# Secret Scanning
2
3	This skill provides procedural guidance for configuring GitHub secret scanning — detecting leaked credentials, preventing secret pushes, defining custom patterns, and managing alerts.
4
5	## When to Use This Skill
6
7	Use this skill when the request involves:
8
9	- Enabling or configuring secret scanning for a repository or organization
10	- Setting up push protection to block secrets before they reach the repository
11	- Defining custom secret patterns with regular expressions
12	- Resolving a blocked push from the command line
13	- Triaging, dismissing, or remediating secret scanning alerts
14	- Configuring delegated bypass for push protection
15	- Excluding directories from secret scanning via `secret_scanning.yml`
16	- Understanding alert types (user, partner, push protection)
17	- Enabling validity checks or extended metadata checks
18	- Scanning local code changes for secrets before committing (via MCP / AI coding agent) — see the Pre-Commit Scanning via AI Coding Agents section below for the recommended plugin
19
20	## How Secret Scanning Works
21
22	Secret scanning automatically detects exposed credentials across:
23
24	- Entire Git history on all branches
25	- Issue descriptions, comments, and titles (open and closed)
26	- Pull request titles, descriptions, and comments
27	- GitHub Discussions titles, descriptions, and comments
28	- Wikis and secret gists
29
30	### Availability
31
32	\| Repository Type \| Availability \|
33	\|---\|---\|
34	\| Public repos \| Automatic, free \|
35	\| Private/internal (org-owned) \| Requires GitHub Secret Protection on Team/Enterprise Cloud \|
36	\| User-owned \| Enterprise Cloud with Enterprise Managed Users \|
37
38	## Core Workflow — Enable Secret Scanning
39
40	### Step 1: Enable Secret Protection
41
42	1. Navigate to repository Settings → Advanced Security
43	2. Click Enable next to "Secret Protection"
44	3. Confirm by clicking Enable Secret Protection
45
46	For organizations, use security configurations to enable at scale:
47	- Settings → Advanced Security → Global settings → Security configurations
48
49	### Step 2: Enable Push Protection
50
51	Push protection blocks secrets during the push process — before they reach the repository.
52
53	1. Navigate to repository Settings → Advanced Security
54	2. Enable "Push protection" under Secret Protection
55
56	Push protection blocks secrets in:
57	- Command line pushes
58	- GitHub UI commits
59	- File uploads
60	- REST API requests
61	- REST API content creation endpoints
62
63	### Step 3: Configure Exclusions (Optional)
64
65	Create `.github/secret_scanning.yml` to auto-close alerts for specific directories:
66
67	```yaml
68	paths-ignore:
69	- "docs/**"
70	- "test/fixtures/**"
71	- "*/.example"
72	```
73
74	Limits:
75	- Maximum 1,000 entries in `paths-ignore`
76	- File must be under 1 MB
77	- Excluded paths also skip push protection checks
78
79	Best practices:
80	- Be as specific as possible with exclusion paths
81	- Add comments explaining why each path is excluded
82	- Review exclusions periodically — remove stale entries
83	- Inform the security team about exclusions
84
85	### Step 4: Enable Additional Features (Optional)
86
87	Non-provider patterns — detect private keys, connection strings, generic API keys:
88	- Settings → Advanced Security → enable "Scan for non-provider patterns"
89
90	AI-powered generic secret detection — uses Copilot to detect unstructured secrets like passwords:
91	- Settings → Advanced Security → enable "Use AI detection"
92
93	Validity checks — verify if detected secrets are still active:
94	- Settings → Advanced Security → enable "Validity checks"
95	- GitHub periodically tests detected credentials against provider APIs
96	- Status shown in alert: `active`, `inactive`, or `unknown`
97
98	Extended metadata checks — additional context about who owns a secret:
99	- Requires validity checks to be enabled first
100	- Helps prioritize remediation and identify responsible teams
101
102	## Core Workflow — Resolve Blocked Pushes
103
104	When push protection blocks a push from the command line:
105
106	### Option A: Remove the Secret
107
108	If the secret is in the latest commit:
109	```bash
110	# Remove the secret from the file
111	# Then amend the commit
112	git commit --amend --all
113	git push
114	```
115
116	If the secret is in an earlier commit:
117	```bash
118	# Find the earliest commit containing the secret
119	git log
120
121	# Start interactive rebase before that commit
122	git rebase -i <COMMIT-ID>~1
123
124	# Change 'pick' to 'edit' for the offending commit
125	# Remove the secret, then:
126	git add .
127	git commit --amend
128	git rebase --continue
129	git push
130	```
131
132	### Option B: Bypass Push Protection
133
134	1. Visit the URL returned in the p

People who liked this also viewed

6 picks

Type

secret-scanning

3.9kinstalls4.6kforks

View on GitHub

How to install secret-scanning?

github/awesome-copilot/secret-scanning

$npx -y skills add github/awesome-copilot --skill secret-scanning

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Secret Scanning
2
3	This skill provides procedural guidance for configuring GitHub secret scanning — detecting leaked credentials, preventing secret pushes, defining custom patterns, and managing alerts.
4
5	## When to Use This Skill
6
7	Use this skill when the request involves:
8
9	- Enabling or configuring secret scanning for a repository or organization
10	- Setting up push protection to block secrets before they reach the repository
11	- Defining custom secret patterns with regular expressions
12	- Resolving a blocked push from the command line
13	- Triaging, dismissing, or remediating secret scanning alerts
14	- Configuring delegated bypass for push protection
15	- Excluding directories from secret scanning via `secret_scanning.yml`
16	- Understanding alert types (user, partner, push protection)
17	- Enabling validity checks or extended metadata checks
18	- Scanning local code changes for secrets before committing (via MCP / AI coding agent) — see the Pre-Commit Scanning via AI Coding Agents section below for the recommended plugin
19
20	## How Secret Scanning Works
21
22	Secret scanning automatically detects exposed credentials across:
23
24	- Entire Git history on all branches
25	- Issue descriptions, comments, and titles (open and closed)
26	- Pull request titles, descriptions, and comments
27	- GitHub Discussions titles, descriptions, and comments
28	- Wikis and secret gists
29
30	### Availability
31
32	\| Repository Type \| Availability \|
33	\|---\|---\|
34	\| Public repos \| Automatic, free \|
35	\| Private/internal (org-owned) \| Requires GitHub Secret Protection on Team/Enterprise Cloud \|
36	\| User-owned \| Enterprise Cloud with Enterprise Managed Users \|
37
38	## Core Workflow — Enable Secret Scanning
39
40	### Step 1: Enable Secret Protection
41
42	1. Navigate to repository Settings → Advanced Security
43	2. Click Enable next to "Secret Protection"
44	3. Confirm by clicking Enable Secret Protection
45
46	For organizations, use security configurations to enable at scale:
47	- Settings → Advanced Security → Global settings → Security configurations
48
49	### Step 2: Enable Push Protection
50
51	Push protection blocks secrets during the push process — before they reach the repository.
52
53	1. Navigate to repository Settings → Advanced Security
54	2. Enable "Push protection" under Secret Protection
55
56	Push protection blocks secrets in:
57	- Command line pushes
58	- GitHub UI commits
59	- File uploads
60	- REST API requests
61	- REST API content creation endpoints
62
63	### Step 3: Configure Exclusions (Optional)
64
65	Create `.github/secret_scanning.yml` to auto-close alerts for specific directories:
66
67	```yaml
68	paths-ignore:
69	- "docs/**"
70	- "test/fixtures/**"
71	- "*/.example"
72	```
73
74	Limits:
75	- Maximum 1,000 entries in `paths-ignore`
76	- File must be under 1 MB
77	- Excluded paths also skip push protection checks
78
79	Best practices:
80	- Be as specific as possible with exclusion paths
81	- Add comments explaining why each path is excluded
82	- Review exclusions periodically — remove stale entries
83	- Inform the security team about exclusions
84
85	### Step 4: Enable Additional Features (Optional)
86
87	Non-provider patterns — detect private keys, connection strings, generic API keys:
88	- Settings → Advanced Security → enable "Scan for non-provider patterns"
89
90	AI-powered generic secret detection — uses Copilot to detect unstructured secrets like passwords:
91	- Settings → Advanced Security → enable "Use AI detection"
92
93	Validity checks — verify if detected secrets are still active:
94	- Settings → Advanced Security → enable "Validity checks"
95	- GitHub periodically tests detected credentials against provider APIs
96	- Status shown in alert: `active`, `inactive`, or `unknown`
97
98	Extended metadata checks — additional context about who owns a secret:
99	- Requires validity checks to be enabled first
100	- Helps prioritize remediation and identify responsible teams
101
102	## Core Workflow — Resolve Blocked Pushes
103
104	When push protection blocks a push from the command line:
105
106	### Option A: Remove the Secret
107
108	If the secret is in the latest commit:
109	```bash
110	# Remove the secret from the file
111	# Then amend the commit
112	git commit --amend --all
113	git push
114	```
115
116	If the secret is in an earlier commit:
117	```bash
118	# Find the earliest commit containing the secret
119	git log
120
121	# Start interactive rebase before that commit
122	git rebase -i <COMMIT-ID>~1
123
124	# Change 'pick' to 'edit' for the offending commit
125	# Remove the secret, then:
126	git add .
127	git commit --amend
128	git rebase --continue
129	git push
130	```
131
132	### Option B: Bypass Push Protection
133
134	1. Visit the URL returned in the p

People who liked this also viewed

6 picks

Type