---
name: GitHub secret scanning
slug: github-secret-scanning
url: https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning
category: Secrets
bestFor: "Finding known credential patterns that were committed to a GitHub repository, and blocking some pushes before they land."
freeTier: yes
price: "Free for public repos"
checks:
  - secrets
freeTierNote: "GitHub's docs say secret scanning runs automatically for free on public repositories. Secret scanning alerts for users and push protection are documented as available for public repositories by default, without buying GitHub Secret Protection. Organization-owned private and internal repositories need GitHub Secret Protection on Team or Enterprise Cloud. Push protection for users, which blocks accidental pushes of secrets to public repositories, is documented as on by default."
verifiedOn: "2026-10-13"
sources:
  - https://docs.github.com/en/code-security/getting-started/github-security-features
  - https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning
unknowns:
  - "A single per-committer price for private-repository scanning. GitHub's docs say that scanning is paid for private repositories."
---

If the app's code is on GitHub, turn the free public-repo protections on and read the alerts. A private hobby repository is not covered by the same default. Check the repository security settings instead of assuming.

Scanning does not rotate a key. If an alert fires, revoke the credential at the provider. Deleting the file in a new commit leaves the secret in history.