Secret Scanning

Detect leaked credentials like API keys, passwords, and tokens before they are abused.

Simple Explanation (ELI5)

Secret scanning is a guard that checks your commits for things that should never be public, like private keys and access tokens.

Technical Explanation

Secret scanning uses pattern matching and provider validation to detect sensitive strings in commits, branches, and history. Partner patterns can trigger provider-side revocation workflows.

Visual Section

Hands-on Commands

# Simulate accidental secret commit
printf "AWS_SECRET_ACCESS_KEY=abc123" >> .env
git add .env
git commit -m "test: add env file"

# Corrective action
git rm --cached .env
echo ".env" >> .gitignore
git add .gitignore
git commit -m "fix: remove env file from tracking"

# Rotate leaked key in cloud provider immediately

Debugging Scenarios

• No alert for obvious secret: Pattern may not be supported; add custom pattern.
• False positive on test string: Mark resolved with reason and refine pattern.
• Secret removed but alert remains: Alert tracks historical leak; rotate key and close appropriately.
• Large history leak: Rotate credentials first, then clean history if policy requires.

Real-world Use Case

A developer committed a cloud API key to a public repo. Secret scanning alert arrived within minutes, key was revoked, and no abuse occurred.

Interview Questions

Summary

Secret scanning is one of the highest-value controls in GHAS because leaked credentials can lead to immediate compromise.