To help you understand ownership and impact of a leaked secret, GitHub secret scanning surfaces enriched metadata for supported secret types. Extended metadata checks are now generally available, including support for multipart validators with supplementary metadata.
What’s new?
These updates expand on existing validity checks to give more actionable context for triage and remediation, enabling development and security teams to assess exposure faster and prioritize remediation.
Secret scanning already performs validity checks for most secret providers, verifying whether a detected secret is active. You can now extend those checks to include additional metadata from supported providers, including details about a secret’s owner, secret creation and expiry dates, and project or organization context.
Metadata is surfaced across list and detail views, including alert list filters, security campaign creation, webhook events, and the REST API. GitHub makes a best effort to display metadata for the secret—metadata availability can vary by secret provider, token type, and possibly even for a specific secret at different points in time.
