high Intelligence

GitHub Secret Scan

Developers accidentally commit secrets — API keys, database passwords, private keys, and access tokens — to Git repositories far more often than you might think. Public repositories containing your domain name or company name can expose credentials that give attackers direct access to your infrastructure.

What SecurityStatus Checks

Public GitHub repositories mentioning your domain name
Common secret patterns: API keys, connection strings, passwords in committed code
Exposed .env files, config files, and credential files in repository history
SSH private keys, PEM files, and certificate private keys

Why This Matters

Exposed secrets in public repositories are among the fastest-exploited vulnerabilities. Automated scanners continuously index GitHub for common secret patterns. AWS access keys exposed in GitHub are typically exploited within minutes of the commit. Credentials in Git history persist even after deletion — the commit history retains them.

How to Fix It

1

Immediately rotate any exposed credentials

If you find credentials in a public repository, rotate them immediately regardless of when they were committed. Do not delete and assume you are safe — assume the secret has already been used. Invalidate the old key, create a new one.
2

Remove secrets from Git history

Deleting a file does not remove it from Git history. Use git-filter-repo (or BFG Repo-Cleaner) to purge secrets from the entire commit history. Then force-push. For GitHub, also contact GitHub Support to clear cached views.
3

Add secret detection to your pre-commit hooks

Install tools like detect-secrets, git-secrets, or Gitleaks as pre-commit hooks. They scan staged files for secrets before each commit, preventing accidental exposure.
4

Use a secrets manager

Never store secrets in code or .env files in repositories. Use AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, or GitHub Actions Secrets for CI/CD. Reference secrets by name in code, not by value.
5

Enable GitHub's secret scanning

GitHub has built-in secret scanning that alerts you when common secret patterns (AWS keys, Stripe keys, etc.) are committed to your repositories. Enable it in your repository settings under Security.

Frequently Asked Questions

Does removing the secret from the repo fix the problem?

No. Anyone who cloned or forked the repository before deletion may have the secret. The commit history retains the secret even after the file is deleted. Always rotate the credential as the primary remediation.

What about private repositories?

Private repositories are safer but not immune. If a private repo becomes public accidentally, or if a contributor's account is compromised, secrets in private repos can be exposed. Store secrets in secrets managers regardless of repo visibility.

How do I scan my own repositories for secrets?

Use tools like Gitleaks (`gitleaks detect --source .`), truffleHog, or GitHub's built-in secret scanning. Run them against your entire repository including history, not just the current working directory.

Related Guides

Check Your Domain Now

Run all 38 security checks including GitHub Secret Scan and get your domain's security grade in under 2 minutes.

Scan Your Domain Free