What is GitHub secret scanning?
GitHub secret scanning is a built-in GitHub feature that looks through your code for things that look like secret keys, such as Stripe, OpenAI or AWS keys, and alerts you when it finds one. Its companion, push protection, blocks the upload before the key is saved.
Also called: Push protection
ON THIS PAGE
What it means
Bots scan public GitHub repositories all day, looking for keys they can use. A key can be found within minutes of being pushed. Secret scanning checks for the same patterns on your side first.
It is free for public repositories and switched on in the repository settings. It matters most for projects made with AI tools, which sometimes paste keys straight into code.
Why it matters for vibe-coded apps
Pushing a key to GitHub is one of the easiest mistakes to make, and removing it later doesn't help, because it stays in your git history.
- You get warned about a leaked key before an attacker uses it.
- Push protection can stop the key from being saved at all.
- It checks your history too, not just your latest files.
Example
A key ends up in a config file that gets committed.
# config.js
export const STRIPE_SECRET = "sk_live_51Nx...";# config.js
export const STRIPE_SECRET = process.env.STRIPE_SECRET;
# .gitignore
.envTurn on secret scanning and push protection as a safety net, but still keep keys out of your code.
How to check if your app has this problem
- 1In your repository, open Settings, then Code security, and see whether Secret scanning and Push protection are on.
- 2Open the Security tab and look for any secret scanning alerts.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Turn on secret scanning and push protection.
- 2Revoke and replace any key that GitHub flags. Removing it from the code isn't enough.
- 3Move keys into environment variables and add .env to .gitignore.
- 4Run a full check, which also reads your code and history.
Make sure no secret keys are hard-coded in my repository. Move any you find into environment variables, add .env to .gitignore, and list every key I need to revoke and replace.
Check if your app has this problem
Paste your website and we'll check for gitHub secret scanning issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- API key exposureA secret key for a paid service ends up where the public can see it.
- Exposed .env fileYour secrets file can be downloaded from your live website.
- Environment variablesSettings stored outside your code, used to keep secrets out of it.
- Key rotationReplacing a secret key with a new one and switching off the old one.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.