Self-hosted alternatives to secret-scanning

S

secret-scanning

Guide for configuring and managing GitHub secret scanning, push protection

secret-scanning is an agent skill from the github/awesome-copilot collection that guides the configuration and management of GitHub secret scanning. It covers detecting leaked credentials in a repository, setting up push protection so secrets are blocked before they reach the repository, defining custom secret patterns with regular expressions, and triaging, dismissing or remediating secret alerts. It also covers resolving a push that has been blocked from the command line, configuring delegated bypass for push protection, excluding directories through a secret_scanning.yml file, understanding the alert types, and enabling validity and extended metadata checks. The skill also points to a way of scanning local changes for secrets before a commit, through an AI coding agent. It is useful for security and platform teams who want credentials kept out of repositories, and for developers who have been blocked by a push and need to know what to do. The most important remediation step is that a secret that has been exposed must be revoked and replaced, since removing it from the code does not remove it from the history. Bypass permissions should be granted sparingly and reviewed. The skill is installed with the skills CLI from the github/awesome-copilot repository. Its skills.sh page showed about 4.5K installs and passing results from three security audits at the time of the scan.