secret-scanning
Guide for configuring and managing GitHub secret scanning, push protection
by githubFree
Description
secret-scanning is an agent skill from the github/awesome-copilot collection that guides the configuration and management of GitHub secret scanning. It covers detecting leaked credentials in a repository, setting up push protection so secrets are blocked before they reach the repository, defining custom secret patterns with regular expressions, and triaging, dismissing or remediating secret alerts. It also covers resolving a push that has been blocked from the command line, configuring delegated bypass for push protection, excluding directories through a secret_scanning.yml file, understanding the alert types, and enabling validity and extended metadata checks. The skill also points to a way of scanning local changes for secrets before a commit, through an AI coding agent. It is useful for security and platform teams who want credentials kept out of repositories, and for developers who have been blocked by a push and need to know what to do. The most important remediation step is that a secret that has been exposed must be revoked and replaced, since removing it from the code does not remove it from the history. Bypass permissions should be granted sparingly and reviewed. The skill is installed with the skills CLI from the github/awesome-copilot repository. Its skills.sh page showed about 4.5K installs and passing results from three security audits at the time of the scan.…
Highlights
- Secret scanning and push protection setup
- Custom patterns with regular expressions
- Triage, dismissal and remediation of alerts
- Delegated bypass and directory exclusions
- Installs with the skills CLI
Ratings & Reviews
No ratings yet
Be the first to rate secret-scanning.
People also visit
secret-scanning FAQ
What does push protection do?
It blocks secrets before they reach the repository, so they are not published.
What should I do after a secret leaks?
Revoke and replace it. Removing it from the code does not remove it from the history.
Who can bypass push protection?
The skill covers delegated bypass, which should be granted sparingly and reviewed.
How do I install it?
Run npx skills add https://github.com/github/awesome-copilot --skill secret-scanning.
What security audits does it have?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best secret-scanning alternatives?
Popular alternatives to secret-scanning include attack-tree-construction, mtls-configuration and pci-compliance. See all secret-scanning alternatives