导航|地址|刷新
GitHub Secret Protection

Skip to content

Navigation Menu
Toggle navigation

Sign in

Platform

AI CODE CREATION

GitHub CopilotWrite better code with AI

GitHub Copilot appDirect agents from issue to merge

MCP RegistryIntegrate external tools

DEVELOPER WORKFLOWS

ActionsAutomate any workflow

CodespacesInstant dev environments

IssuesPlan and track work

Code ReviewManage code changes

Code QualityEnforce quality at merge

APPLICATION SECURITY

GitHub Advanced SecurityFind and fix vulnerabilities

Code securitySecure your code as you build

Secret protectionStop leaks before they start

EXPLORE
Why GitHub

Documentation

Blog

Changelog

Marketplace

View all features

Solutions

BY COMPANY SIZE
Enterprises

Small and medium teams

Startups

Nonprofits

BY USE CASE
App Modernization

DevSecOps

DevOps

CI/CD

View all use cases

BY INDUSTRY
Healthcare

Financial services

Manufacturing

Government

View all industries

View all solutions

Resources

EXPLORE BY TOPIC
AI

Software Development

DevOps

Security

View all topics

EXPLORE BY TYPE
Customer stories

Events & webinars

Ebooks & reports

Business insights

GitHub Skills

SUPPORT & SERVICES
Documentation

Customer support

Community forum

Trust center

Partners

View all resources

Open Source

COMMUNITY

GitHub SponsorsFund open source developers

PROGRAMS
Security Lab

Maintainer Community

Accelerator

GitHub Stars

Archive Program

REPOSITORIES
Topics

Trending

Collections

Enterprise

ENTERPRISE SOLUTIONS

Enterprise platformAI-powered developer platform

AVAILABLE ADD-ONS

GitHub Advanced SecurityEnterprise-grade security features

Copilot for BusinessEnterprise-grade AI features

Premium SupportEnterprise-grade 24/7 support

Pricing

Search or jump to...

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted

Cancel Submit feedback

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Cancel Create saved search

Sign in
Sign up Resetting focus

You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert

{{ message }}

GitHub Security

Advanced Security

Secret Protection

Code Security

Supply Chain Security

Plans & pricing

GitHub Secret Protection
Keep your secrets secret

GitHub Secret Protection continuously monitors your GitHub perimeter, helping prevent exposures, protect credentials, and ship securely.

Request a demo See plans & pricing

What is GitHub Secret Protection?

4.4M Secrets prevented from leaking on GitHub in 2024

150+ Industry partners, working together to mitigate risk for the developer community

39M Secret leaks detected with Secret Protection in 2024

Prevent accidental secret exposure
across your repositories

Block leaks before they happen

Push protection automatically blocks secrets before they reach your repository, keeping code clean without disrupting workflows.

Find the threats that others miss

Detect secrets in issues, discussions, and more with secret scanning. Metadata like validity checks and public leaks help prioritize active threats.

Give Copilot the heavy lifting

GitHub Copilot finds elusive secrets like passwords without the false positives. It detects secrets that traditional secret detectors are less likely to catch, providing an additional layer of security.

Standardize enforcement, simplify compliance

Manage policies like delegated bypass for push protection, alert dismissal restrictions, and built-in enablement configurations, simplifying security enforcement at scale.

One-click risk assessment

Evaluate exposure to application vulnerabilities and leaked secrets in your codebase with our free risk assessment tool.

Explore GitHub security risk assessments

Powered by a global security partnership

GitHub partners with 150+ providers to mitigate risks and ensure the highest level of detection accuracy.
Learn about the secret scanning partner program

Safer code for everyone

Whether you're securing an open source project or strengthening your enterprise codebase, Secret Protection helps you keep secrets out of your code.

Request a demo See plans & pricing

Resources to get started

Discover developer-first application security

Take an in-depth look at the current state of application security.

View the webinar

Explore the DevSecOps guide

Learn how to build security into your code from day one with DevSecOps.

Read the whitepaper

Avoid AppSec pitfalls

Explore common application security pitfalls and how to avoid them.

Read the whitepaper

FAQs

What is GitHub Secret Protection?

GitHub Secret Protection detects and prevents secret leaks continuously in real-time, proactively blocking sensitive credentials from being pushed to a repository with push protection. With a remarkably low false positive rate and approximately 150 service provider integrations, it enables rapid credential revocation and rotation, enhancing developer productivity.

What is the secret risk assessment?

The secret risk assessment provides a free, comprehensive overview of an organization’s secret leak footprint across its GitHub repositories. By analyzing repositories for exposed secrets, it helps admins and developers understand their exposure to potential security risks and offers actionable insights for remediation. Learn more about GitHub security risk assessments.

What is push protection?

Push protection is designed to prevent sensitive information, such as secrets or tokens, from being pushed to your repository in the first place. It proactively scans your code for secrets during the push process and blocks the push if any are detected.

What is delegated bypass for push protection?

Delegated bypass introduces an approval process for developers to bypass push protection. Anyone opting to bypass a push protection block will need to submit a request to a designated group of reviewers, ensuring any risky secrets are not accidentally leaked.

What are secret scanning validity checks?

Validity checks help you determine whether detected secrets are still active, enabling developers and security teams to prioritize their response effectively. When a secret is flagged, the system verifies its validity to confirm whether the secret is active or inactive.

What is the secret scanning partnership program?

The secret scanning partnership program allows service providers to secure their token formats by enabling GitHub to scan public repositories and npm packages for exposed secrets. When a secret is found in a public repo, GitHub sends an alert directly to the service provider, who can then validate and take appropriate action.

Site-wide Links

The developer newsletter

Get tips, technical guides, and best practices. Twice a month. Right in your inbox.
Subscribe

Platform

Features

Enterprise

Copilot

AI

Security

Pricing

Team

Resources

Roadmap

Compare GitHub

Ecosystem

Developer API

Partners

Education

GitHub CLI

GitHub Desktop

GitHub Mobile

GitHub Marketplace

MCP Registry

Support

Docs

Community Forum

Professional Services

Premium Support

Skills

Status

Contact GitHub

What is Git?

Sitemap

Company

About

Why GitHub

Customer Stories

Blog

The ReadME Project

Careers

Newsroom

Inclusion

Social Impact

Shop

© 2026 GitHub, Inc.

Terms

Privacy

Manage cookies

Do not share my personal information

GitHub on LinkedIn

GitHub on Instagram

GitHub on YouTube

GitHub on X

GitHub on TikTok

GitHub on Twitch

GitHub’s organization on GitHub

English

You can’t perform that action at this time.

------
导航页打开网址