Monitoring alerts from secret scanning

Learn how and when GitHub Enterprise Cloud will notify you about a secret scanning alert.

Who can use this feature?

Secret scanning alerts for partners runs automatically on public repositories and public npm packages to notify service providers about leaked secrets on GitHub.

Secret scanning alerts for users are available for user-owned public repositories for free. Organizations using GitHub Enterprise Cloud with a license for GitHub Advanced Security can also enable secret scanning alerts for users on their private and internal repositories. Additionally, secret scanning alerts for users are available and in beta on user-owned repositories for GitHub Enterprise Cloud with Enterprise Managed Users. For more information, see "About secret scanning alerts" and "About GitHub Advanced Security."

For information about how you can try GitHub Advanced Security for free, see "Setting up a trial of GitHub Advanced Security."

Configuring notifications for secret scanning alerts

In addition to displaying an alert in the Security tab of the repository, GitHub Enterprise Cloud can also send email notifications for alerts. These notifications are different for incremental scans and historical scans.

Incremental scans

When a new secret is detected, GitHub Enterprise Cloud notifies all users with access to security alerts for the repository according to their notification preferences. These users include:

Repository administrators
Security managers
Users with custom roles with read/write access
Organization owners and enterprise owners, if they are administrators of repositories where secrets were leaked

Note

Commit authors who've accidentally committed secrets will be notified, regardless of their notification preferences.

You will receive an email notification if:

You are watching the repository.
You have enabled notifications for "All Activity", or for custom "Security alerts" on the repository.
In your notification settings, under "Subscriptions", then under "Watching", you have selected to receive notifications by email.

On GitHub, navigate to the main page of the repository.
To start watching the repository, select Watch.
In the dropdown menu, click All Activity. Alternatively, to only subscribe to security alerts, click Custom, then click Security alerts.
Navigate to the notification settings for your personal account. These are available at https://github.com/settings/notifications.
On your notification settings page, under "Subscriptions", then under "Watching", select the Notify me dropdown.
Select "Email" as a notification option, then click Save.

For more information about setting up notification preferences, see "Managing security and analysis settings for your repository" and "Configuring your watch settings for an individual repository."

Historical scans

For historical scans, GitHub Enterprise Cloud notifies the following users:

Organization owners, enterprise owners, and security managers—whenever a historical scan is complete, even if no secrets are found.
Repository administrators, security managers, and users with custom roles with read/write access—whenever a historical scan detects a secret, and according to their notification preferences.

We do not notify commit authors.