Introduction
GitHub's security features help keep code and secrets secure in repositories and across organizations. Some features are available for all repositories while others are only available for public repositories and for private repositories with a GitHub Advanced Security license.
Imagine that you're the administrator of a GitHub project involving several repositories that communicate with multiple external services. You would like to make sure that no authentication credentials for these services get committed in the repositories of the project. Luckily, your company just purchased a GitHub Advanced Security license that includes secret scanning, a GitHub feature that does just that! To configure and use secret scanning for your project, you really need to understand what secret scanning is, how it works and the options available to you according to your use case.
In this module, you'll learn about:
- How secret scanning works and who it's available to
- How to prevent secret leaks by enabling push protection
- How to enable secret scanning on your repository
- How to configure secret scanning according to your use case
- How to use secret scanning efficiently
Learning objectives
By the end of this module, you'll be able to:
- Describe secret scanning
- Describe push protection
- Describe validity checks
- Enable secret scanning
- Customize secret scanning
- Use secret scanning
Prerequisites
Individual with public repository
- A GitHub account
- Administrative access to a public repository
- Familiarity with managing GitHub administrative settings
- Basic knowledge of git commit and git push
Organization with private repository
- A GitHub enterprise account with a GitHub Advanced Security license
- Repository administrator or organization owner permissions
- Familiarity with managing GitHub administrative settings
- Basic knowledge of GitHub Actions