name: Shreesha S Nekkar handle: @shreeshasn role: Software Engineer base: Mysuru, Karnataka status: Building projects that doesn't break (most of the time) current: VoxGlobal AI @ Artsy Technologies event-driven dubbing platform 3 microservices, 1 intern, 0 sleep vibe: "GUI is just CLI with extra steps" seeking: Interesting problems + good engineers #199429
Replies: 2 comments
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.

Uh oh!
There was an error while loading. Please reload this page.
-
🏷️ Discussion Type
Product Feedback
Body
Secret leakage risks
Secrets like API keys, passwords, and tokens committed to repositories can be exploited by unauthorized users, creating security, compliance, and financial risk to your organization.
What are secrets?
Secrets are credentials that grant access to sensitive systems and data. Common examples include:
When secrets are committed to repositories, they become hardcoded credentials that are embedded directly in your source code or configuration files. These hardcoded secrets become part of your Git history and remain accessible even after being removed from the latest commit. This means that addressing a credential leak requires more than deleting the file; you must also revoke and replace the credential to prevent unauthorized access.
How secrets get exposed
Secret sprawl occurs when credentials proliferate across repositories, teams, and systems without centralized management or visibility. This makes it difficult to track which secrets exist, where they're used, and whether they've been exposed. Secrets typically enter repositories through several common patterns.
Development workflows
.envfiles or infrastructure-as-code templatesRepository management
Version control propagation
Security risks
Exposed secrets can lead to several types of security incidents.
Unauthorized access
Credential leaks give unauthorized users direct access to your systems. Once exposed, hardcoded secrets can be exploited to:
Data breaches
Credential leaks give unauthorized users direct access to your systems, leading to data breaches. Once attackers gain access using exposed credentials, they can exfiltrate sensitive data, modify or delete critical information, and compromise customer trust. Data breaches require immediate incident response, including credential revocation, system remediation, and assessment of the breach's scope and impact.
Supply chain attacks
Exposed package registry tokens can be used to publish malicious versions of your software, affecting downstream users and organizations that depend on your packages.
Financial impact
Exposed secrets can cost your organization money in several ways.
Secret security with GitHub
GitHub provides tools to help you prevent, detect, and remediate secret leakage:
1. Prevent new secrets from being committed
Enable Push protection to scan code during
git pushoperations and block commits containing detected secrets before they enter your repository. This prevents hardcoded credentials from being added to your codebase and provides real-time feedback to developers at the point of risk, covering both provider patterns for known services and non-provider patterns such as private keys and generic API keys.Encourage individual developers to enable push protection for their personal accounts to protect all their pushes across GitHub, regardless of organization policies. This helps prevent secret sprawl by catching leaked credentials before they reach your repositories.
2. Detect existing secrets
Use secret scanning to continuously monitor your repositories for hardcoded secrets and generate alerts when credentials are detected, enabling you to revoke and rotate compromised credentials quickly. Beyond default detection of provider patterns, you can expand scanning to non-provider patterns and define custom patterns for organization-specific secrets. This helps you gain visibility into secret sprawl across your organization.
Beta Was this translation helpful? Give feedback.
All reactions