Chapter 2 · Practice 1 of 4
Turn on secret scanning and push protection
Why it matters
Two GitHub features work together here, and you want both on.
| Feature | What it does |
|---|---|
| Secret scanning | Checks your full git history, issues, pull requests and more for known credential formats. Free for public repositories. For many providers, GitHub also notifies the provider, who may revoke the key. |
| Push protection | Blocks a push that contains a secret before it lands. |
Scanning tells you after the fact; push protection stops the leak in the first place.
Who has to turn it on:
- Personal account, public repository: push protection is on by default.
- Organization repositories: an admin enables it at the repository or organization level.
- Private repositories: need GitHub Secret Protection.
Check under the repository's security settings that both features are enabled. See About push protection for the details.