{"id":76800,"date":"2024-02-29T09:00:41","date_gmt":"2024-02-29T17:00:41","guid":{"rendered":"https:\/\/github.blog\/?p=76800"},"modified":"2024-02-29T10:34:06","modified_gmt":"2024-02-29T18:34:06","slug":"keeping-secrets-out-of-public-repositories","status":"publish","type":"post","link":"https:\/\/github.blog\/news-insights\/product-news\/keeping-secrets-out-of-public-repositories\/","title":{"rendered":"Keeping secrets out of public repositories"},"content":{"rendered":"\n

Accidental leaks of API keys, tokens, and other secrets risk security breaches, reputation damage, and legal liability at a mind-boggling scale. In just the first eight weeks of 2024, GitHub has detected over 1 million leaked secrets on public repositories. That’s more than a dozen accidental leaks every minute<\/em>.<\/p>\n

Since last August, all GitHub cloud users could opt-in<\/a> to secret scanning push protection, which automatically blocks commits when a secret is detected. Now, we’ve enabled secret scanning push protection by default for all pushes to public repositories.<\/p>\n

What’s changing<\/span><\/a><\/h2>\n

This week, we began the rollout of push protection for all users. This means that when a supported secret<\/a> is detected in any push to a public repository, you will have the option to remove the secret from your commits or, if you deem the secret safe, bypass the block. It might take a week or two for this change to apply to your account; you can verify status and opt-in early in code security and analysis settings<\/a>.<\/p>\n

How will this change benefit me?<\/span><\/a><\/h2>\n

Leaked secrets can pose a risk to reputation, revenue, and even legal exposure, which is why GitHub Advanced Security customers scan more than 95% of pushes to private repositories. As champions for the open source community, we believe that public repositories–and your reputation as a coder–are worth protecting, too.<\/p>\n

Do I have a choice?<\/span><\/a><\/h2>\n

Yes. Even with push protection enabled, you have the choice to bypass the block. Although we don’t recommend it, you can also disable push protection entirely in your user security settings<\/a>. However, since you always retain the option to bypass the block, we recommend that you leave push protection enabled and make exceptions on an as-needed basis.<\/p>\n

What about private repositories?<\/span><\/a><\/h2>\n

If your organization is on the GitHub Enterprise<\/a> plan, you can add GitHub Advanced Security<\/a> to keep secrets out of private repositories as well. You’ll also get all of the other features for secret scanning<\/a>, along with code scanning<\/a>, AI-powered autofix<\/a> code suggestions, and other static application security (SAST) features as part of a comprehensive DevSecOps platform solution.<\/p>\n

Learn more about secret scanning<\/span><\/a><\/h2>\n

GitHub secret scanning guards over 200 token types and patterns from more than 180 service providers, and boasts the industry’s highest precision and lowest rate of false positives.1<\/a><\/sup> Together, we can keep secrets from leaking on public repositories.<\/p>\n