GitHub has announced that organizations with its GitHub Advanced Security, which is available to customers with enterprise accounts on GitHub Enterprise Cloud and GitHub Enterprise Server 3.0, can now make use of push protection with its secret scanning option to protect against secret leaks.

The advanced security is also enabled for public repositories on GitHub.com. 

What GitHub means by secret scanning is checking of items such as tokens or private keys used for authentication. Encrypted secrets can be used to store sensitive information, such as access tokens, in your repository. Secret scanning scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally.

The new feature's "push protection" refers to the embedding of secret scanning in the developer workflow. GitHub has been working on this development for some time, and last year changed the format of their own secrets and started collaborating with other token issuers to persuade them to make their tokens highly identifiable.

GitHub is now launching the push protection with support for 69 high confidence patterns that each have a signal-to-noise ratio. With push protection, GitHub will check for these secrets as developers push code and block the push if a secret is identified. The GitHub team says that high-confidence secrets have a low positive rate, so security teams can protect their organizations without compromising developer experience.

The checks look for over 100 different token types to detect secrets. If a secret is identified, developers can review and remove the secrets from their code before pushing again.

If there's a situation where this would hold up important work, developers can bypass the protection, in which case GitHub will generate a security alert for the developer and the repository administrator to collaborate on.

GitHub Secret Scanning is available now.

More Information

GitHub Enterprise

Related Articles

GitHub Improves Code Search

GitHub Code Scanning Now Uses Machine Learning

GitHub Enterprise Adds Centralized User Accounts

Visual Studio Integrates GitHub Accounts

GitHub Enterprise 2.14 Adds Unified Search

GitHub Enterprise Adds Team Discussions

GitHub Enterprise Adds Global Webhooks 

GitHub Enterprise 2.1 Released

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.

Comments

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info