Introducing extended metadata checks for secret scanning

[ghostinhershell]

To help you understand ownership and impact of a leaked secret, GitHub secret scanning now surfaces additional metadata for supported secret types.

What's changing?

Secret scanning already performs validity checks for most secret providers, verifying whether a detected secret is active. This update extends those checks to include additional metadata fields from supported providers.

Available in public preview for supported secret types, alerts now display details about a secret's owner, secret creation and expiry dates, and project or organization context when information is available from the secret provider. For example, leaked OpenAI keys will display the secret owner's name, email, and identifier, in addition to information about the organization when available. These new metadata keys expand on existing validity checks to give more actionable context for triage and remediation, enabling development and security teams to assess exposure faster and prioritize remediation.

Please note, metadata availability will vary by secret provider, token type, and possibly even for a specific secret at different points in time. GitHub makes a best effort to display metadata for the secret, but not all metadata keys may be available for a secret.

What secret types are supported?

GitHub will continually add support for additional secret types on a rolling basis. In addition to previously announced support for active GitHub tokens, metadata checks are now supported for the following types:

Provider	Token	Extended Metadata
Adafruit	ADAFRUIT_AIO_KEY	✅
Anthropic	ANTHROPIC_API_KEY	✅
Apify	APIFY_API_TOKEN	✅
Contentful	CONTENTFUL_PERSONAL_ACCESS_TOKEN	✅
Discord	DISCORD_API_TOKEN	✅
Discord	DISCORD_API_TOKEN_V2	✅
Dropbox	DROPBOX_OAUTH2_ACCESS_TOKEN	✅
Dropbox	DROPBOX_OAUTH2_SHORT_LIVED_ACCESS_TOKEN	✅
Fastly	FASTLY_API_TOKEN	✅
Figma	FIGMA_PAT	✅
GitLab	GITLAB_ACCESS_TOKEN	✅
Google	GOOGLE_OAUTH_ACCESS_TOKEN	✅
Hugging Face	HUGGING_FACE_USER_ACCESS_TOKEN	✅
Intercom	INTERCOM_ACCESS_TOKEN	✅
Mailchimp	MAILCHIMP_API	✅
Mailgun	MAILGUN	✅
Mailgun	MAILGUN_LEGACY	✅
Mapbox	MAPBOX_SECRET_ACCESS_TOKEN	✅
Notion	NOTION_INTEGRATION_TOKEN	✅
OpenAI	OPENAI_API_KEY	✅
OpenAI	OPENAI_API_KEY_V2	✅
Postman	POSTMAN_API_KEY_V2	✅
SendGrid	SENDGRID_API_KEY	✅
Slack	SLACK	✅
Slack	SLACK_OPAQUE	✅
Stripe	STRIPE_LIVE_API_SECRET_KEY	✅
Stripe	STRIPE_TEST_API_SECRET_KEY	✅
Tailscale	TAILSCALE_API_KEY	✅
Telegram	TELEGRAM_BOT_TOKEN	✅
Terraform Cloud	TERRAFORM_CLOUD_ENTERPRISE_TOKEN	✅

See the full list of supported secrets or keep an eye on the GitHub changelog for updates.

When is the analysis run for a given secret?

GitHub will run extended metadata checks for secret scanning alerts when a secret is both confirmed active and in the list of supported secret types. In addition, an admin or security manager first needs to enable extended metadata checks for a given repository.

Where is metadata displayed?

Extended metadata is shown in the right-hand side of an alert, along with additional information about the alert, like alert assignees or associated security campaigns.

Who can use this feature?

Extended metadata checks are available in public preview for GitHub Secret Protection and GitHub Advanced Security customers on github.com, including GitHub Enterprise Cloud with data residency.

Get started with metadata checks

The feature can be enabled from the repository settings page. Validity checks must be enabled in order to enable the extended checks. Once enabled, additional information will be displayed in the alert details view for active secrets when available.

Learn more and share feedback

Learn more about securing your repositories with secret scanning and join the discussion by leaving feedback in the comments below!

[alexdima]

👋 Coming here from a secret alert. Here is what I did:

• I went to https://www.uuidgenerator.net/version4
• it generated a UUID for me: 98082ef0-a97b-4af3-afe1-4e0a1a874fe4
• I included this value in an issue: https://github.com/microsoft/vscode-internalbacklog/issues/6222#issue-3590262871
• I got an alert that this UUID is an OpenVSX Access Token https://github.com/microsoft/vscode-internalbacklog/security/secret-scanning/10

Just wanted to share that IMHO it is statistically highly unlikely for this to be someone's valid access token since I generated it and that UUIDs are a common concept that people use, which do not imply secrets, so I believe the scanning will have a lot of false positives on this.

[nbuckwalt]

👋 Also coming here from a false positive secret alert.

Seems like the "GitHub App Installation Access Token" pattern matches on generic md5 hashes, which we sometimes use in filenames. It seems this rule alerts whenever "v1." is prepended to the beginning a md5 hash value, no matter where it is found (in this case, part of a filename). The rule does not match on "v2.".

[AyeshaIftikhar]

Somehow, i am getting security alerts for files that has been removed from repo months ago.