secret-scanning

Navigate to repository Settings, then Advanced Security, and enable Secret Protection followed by Push protection. For organizations, use security configurations under Global settings to enable both features at scale across repositories.

Remove the secret by amending the latest commit with git commit --amend, or use interactive rebase for earlier commits. Alternatively, visit the bypass URL from the error message, select a reason, and re-push within 3 hours.

Go to Settings, Advanced Security, Custom patterns, and select New pattern. Enter a name and regex, add a sample test string, run a dry run to check up to 1,000 results for false positives, then publish the pattern.

Secret scanning is automatic and free on public repositories. Private and internal organization-owned repositories require GitHub Secret Protection, available on Team or Enterprise Cloud plans.

Rotate the exposed credential immediately by revoking and reissuing it, since this matters more than removing it from Git history. Then check the validity status, update references, investigate usage during exposure, and close the alert.

Create a .github/secret_scanning.yml file with a paths-ignore list of glob patterns for directories like docs or test fixtures. The file supports up to 1,000 entries, and excluded paths also skip push protection checks.