Secret Scanning

ELI5 — The Vibe Check

Secret Scanning checks your code for accidentally committed passwords, API keys, and tokens. Pushed your AWS key to GitHub? Secret Scanning catches it and alerts you (or auto-revokes it). It's like a metal detector at the airport, but for credentials in your code.

Real Talk

Secret scanning analyzes Git repositories for accidentally committed credentials, API keys, tokens, and other secrets. GitHub's native secret scanning detects patterns from partner providers and can auto-revoke leaked tokens. Tools like GitLeaks, TruffleHog, and detect-secrets provide additional coverage.

Show Me The Code

# Run gitleaks locally
gitleaks detect --source . --verbose

# In CI
gitleaks detect --source . --report-format json --report-path report.json

When You'll Hear This

"Secret scanning caught an API key in a test fixture before it reached main." / "GitHub auto-revoked the AWS key 30 seconds after it was pushed."