GitHub secret scanning
Finding known credential patterns that were committed to a GitHub repository, and blocking some pushes before they land.
Last updated
- Free tier
- Yes
- Checked
- 2026-10-13
What the public pages say
If the app's code is on GitHub, turn the free public-repo protections on and read the alerts. A private hobby repository is not covered by the same default. Check the repository security settings instead of assuming.
Scanning does not rotate a key. If an alert fires, revoke the credential at the provider. Deleting the file in a new commit leaves the secret in history.
Free tier
GitHub's docs say secret scanning runs automatically for free on public repositories. Secret scanning alerts for users and push protection are documented as available for public repositories by default, without buying GitHub Secret Protection. Organization-owned private and internal repositories need GitHub Secret Protection on Team or Enterprise Cloud. Push protection for users, which blocks accidental pushes of secrets to public repositories, is documented as on by default.
Not stated on the vendor's site
- A single per-committer price for private-repository scanning. GitHub's docs say that scanning is paid for private repositories.
Sources
- https://docs.github.com/en/code-security/getting-started/github-security-features
- https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning
Markdown version · Canonical page: https://shipsecurely.dev/tools/github-secret-scanning