Public secret monitoring has been upgraded with a set of alert‑management features and automation hooks. Teams can now act on leaked credentials directly from the enterprise security dashboard, see live token validity, and pull findings via API or receive them through webhooks.
Alert triage UI and workflow
The dashboard now supports dismissing or marking alerts as fixed, adding optional comments, and reopening alerts when circumstances change. An activity timeline records every state change, providing an audit trail. Filters let you narrow the list by repository, committer, secret type, attribution method (membership or verified domain), and open/closed state. Closing an alert updates its status in the system but does not revoke the exposed credential or remove it from the public repository.
Continuous token validity checks
For supported secret providers, the service now runs ongoing validity checks. Each alert displays a status of Active, Inactive, or Unknown, helping security teams prioritize live tokens over stale ones. This visibility is limited to the providers explicitly supported by the feature.
API and webhook integration
Enterprise administrators can query alerts programmatically using the endpoint GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts. The response includes alert metadata, secret type, attribution, and exposed locations. At the enterprise level, you can subscribe to the secret_scanning_public_monitoring_alert webhook event to receive real‑time notifications whenever a new leak is attributed to your organization.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Teams should update their incident‑response playbooks to incorporate the new dismissal workflow and token‑status signals, ensuring that active credentials receive immediate containment. Automation pipelines can now ingest alerts via the REST endpoint or webhook, enabling centralized ticket creation or automated remediation steps. Because the feature is in public preview and included with existing GitHub Advanced Security or Secret Protection licenses, no additional cost is incurred, but you must enable it in the enterprise security dashboard.
