Repository has secret scanning enabled

Check ID: repository_secret_scanning_enabled
Provider: GitHub
Service: repository
Severity: HIGH
Categories: secrets
Resource type: NotDefined

Risk

Without secret scanning, exposed credentials can persist unnoticed, enabling:

Unauthorized access to cloud and third-party services

Supply-chain compromise via tampered pipelines

Data exfiltration and repo takeover

This degrades confidentiality and integrity, and increases blast radius of a single leaked key.

Recommendation

Enable secret scanning (and push protection where available) across repositories.

Store secrets in a dedicated secrets manager, never in code

Define custom patterns and enable generic detection for org-specific secrets

Rotate and revoke exposed credentials quickly

Enforce least privilege and add defense-in-depth monitoring

Remediation

CLI
Terraform
Dashboard steps

gh api -X PATCH repos/<OWNER>/<REPO> -H "Accept: application/vnd.github+json" -H "Content-Type: application/json" -d '{"security_and_analysis":{"secret_scanning":{"status":"enabled"}}}'

resource "github_repository" "<example_resource_name>" {
  name = "<example_resource_name>"

  security_and_analysis {
    secret_scanning {           # Critical: enable secret scanning
      status = "enabled"       # Turns on secret scanning for the repository
    }
  }
}

Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = repository_secret_scanning_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

Repository has secret scanning enabled

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires