GitHub Announces Updates to Secret Scanning
According to GitHub. GitHub introduces audit log changes and technical improvements to its secret scanning infrastructure.
- • Audit log events will transition to using enterprise slugs instead of display names.
- • Secret scanning now automatically decodes Base64-encoded GitHub tokens for revocation.
- • API and webhook improvements provide better error handling and correlation for developers.
Audit Log Event Changes
Effective November 12, 2026, the business field in secret_scanning_alert and secret_scanning_push_protection.bypass audit log events will shift from the enterprise display name to the enterprise slug. GitHub advises users to update integrations that filter by display name to accept both formats or transition to using the business_id to ensure continued functionality.
Enhanced Secret Revocation
GitHub has expanded its revocation action for private and internal repositories to support Base64-encoded tokens. This includes classic personal access tokens, fine-grained tokens, OAuth tokens, and GitHub App user tokens. The platform now automatically decodes these values, streamlining the security response process for developers.
System Improvements and Bug Fixes
The update addresses several technical issues, including fixing empty metadata in bypass-request API responses and resolving push failures related to delegated bypass configurations. Additionally, the custom pattern API now returns a 422 error code for invalid arguments, allowing integrations to better distinguish between input errors and server-side failures.
- 1. github.blogOpen source