GitHub's Secret Scanning Partner Program helps service providers secure their secret token formats by detecting accidental exposure of secrets in repositories. With secret scanning, GitHub identifies and alerts on known secret formats in public repositories, public npm packages, and optionally in private repositories configured for secret scanning.
As a service provider, partnering with GitHub ensures your secret formats are protected. When a match for your secret format is found:
- For public repositories, GitHub sends a payload to an HTTP endpoint of your choice for verification and action.
- For private repositories, repository admins and committers are alerted directly within GitHub, allowing them to view and manage the exposure securely.
This program is designed to prevent the misuse of accidentally exposed credentials and safeguard your customers’ data.