github / github/roadmap

Secret scanning: `public leak` (high priority) and `multi-repo` (deduping) indicators for alerts [GA]

Open
#1,040 0 comments 0 reactions 0 assignees View on GitHub
Enterprise Free GA GitHub Advanced Security (GHAS) Shipped
Dominant language
No language data
Stars
8.9k
Forks
1.8k
PR merge metrics
No merged PRs in 30d

Description

### Value Prop

To help you triage and remediate secret leaks more effectively, GitHub secret scanning indicates if a secret detected in your repository has also leaked publicly with a `public leak` label on the alert. The alert also indicates if the secret was exposed in other repositories across your organization or enterprise with a `multi-repo` label.

### Expected Outcome

These labels provide additional understanding into the distribution of an exposed secret, while also making it easier to assess an alert’s risk and urgency. For example, a secret which has a known associated exposure in a public location has a higher likelihood of exploitation. Detection of public leaks is only currently supported for [provider-based patterns](https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#default-patterns).

The `multi-repo` label makes it easier to de-duplicate alerts and is supported for all secret types, including [custom patterns](https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/defining-custom-patterns-for-secret-scanning). You can only view and navigate to other enterprise repositories with duplicate alerts if you have appropriate permissions to view them.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.